[Hiring] Cybersecurity Assessor III @ECS Tech Inc

Role Description

ECS is seeking a highly experienced Cybersecurity Assessor – Level 3 to join an enterprise-scale cybersecurity program supporting a major federal civilian agency. This position supports remote work, with preference given to candidates residing in or near the National Capital Region (NCR).

In this role, you will:

• Lead complex cybersecurity security control assessments across enterprise information systems, applications, cloud environments, and supporting infrastructure to evaluate security effectiveness and compliance with federal requirements.
• Plan and coordinate security assessments, including defining assessment scope, selecting methodologies, establishing testing procedures, and identifying evidence requirements in accordance with NIST SP 800-53A and the NIST Risk Management Framework (RMF).
• Evaluate the design, implementation, and effectiveness of technical, operational, and management security controls, identifying systemic weaknesses, control gaps, and significant cybersecurity risks.
• Lead technical assessment activities involving system configurations, security architectures, cloud services, access controls, vulnerability management, and continuous monitoring capabilities.
• Review and validate assessment evidence, technical findings, risk ratings, and supporting documentation to ensure accuracy, consistency, and defensibility.
• Develop and review comprehensive Security Assessment Reports (SARs), risk assessments, and supporting authorization artifacts that communicate findings, potential impacts, and recommended corrective actions.
• Provide senior-level assessment expertise to ISSOs, system owners, cybersecurity engineers, and government stakeholders regarding security control requirements, assessment findings, and remediation priorities.
• Support Authority to Operate (ATO) and ongoing authorization processes by evaluating security control effectiveness, identifying residual risks, and providing technical assessment results to designated authorization officials.
• Evaluate remediation plans and POA&M activities, prioritize reassessment efforts, and validate corrective actions addressing significant security control deficiencies.
• Lead assessment quality reviews, develop standardized assessment methodologies, and recommend improvements to evidence collection, control testing, reporting, and risk evaluation practices.
• Coordinate with cybersecurity operations, vulnerability management, security engineering, and compliance teams to incorporate relevant technical findings and continuous monitoring information into assessment activities.
• Mentor junior and mid-level assessors, provide technical guidance on complex assessments, and communicate significant security risks and recommended improvements to cybersecurity leadership and government stakeholders.

Qualifications

• U.S. Citizenship required.
• Remote position, with preference for candidates residing within close proximity to the National Capital Region (NCR).
• Active Public Trust 6C determination, or the ability to obtain and maintain the required determination.
• Bachelor Degree and 5 years of experience, Master's Degree and 3 years of experience or a PhD and 0 years of experience in Cybersecurity, Information Technology, Information Systems, Computer Science, Engineering, or a related field (or equivalent professional experience).
• 7+ years of relevant experience in cybersecurity assessments, security control evaluation, risk management, information system security, or federal cybersecurity compliance.
• Demonstrated experience leading complex security control assessments, developing assessment methodologies, evaluating technical evidence, and producing comprehensive assessment findings.
• Advanced knowledge of federal cybersecurity requirements, including FISMA, NIST SP 800-53, NIST SP 800-53A, NIST SP 800-37, and the NIST Risk Management Framework (RMF).
• Strong understanding of enterprise security architectures, cloud security, network security, identity and access management, vulnerability management, and technical security control implementation.
• Extensive experience supporting security authorization activities, evaluating security risks, reviewing SSPs and SARs, and assessing remediation activities and POA&Ms.
• Strong technical leadership, analytical, risk assessment, documentation, and communication skills, with demonstrated ability to guide assessment personnel and communicate complex security findings to senior stakeholders.

Company Description