[Hiring] Security Controls Assessor - Senior @Cherokee Federal

Role Description

The Senior Security Controls Assessor provides independent assessments of MARAD information systems in support of system authorization, reauthorization, and continuous monitoring activities. This role evaluates management, operational, and technical security controls in accordance with NIST Risk Management Framework (RMF) requirements, supports Authority to Operate (ATO) decisions, develops assessment documentation and reports, and collaborates with MARAD, DOT, and cybersecurity stakeholders to ensure compliance, risk visibility, and mission assurance.

Responsibilities

• Assess MARAD systems in one of three states: System Authorization, Reauthorization, or Continuous Monitoring Assessment (CMA).
• Provide annual assessment support to the NSMV and MARAD CIO programs, including on-site evaluations at the Philadelphia shipyard and other locations.
• Conduct independent assessments of specified MARAD information systems following the System Authorization process.
• Review existing information system core documentation, including privacy requirements data, to support development of security assessment plans and schedules.
• Identify non-compliance of security requirements and possible mitigations.
• Validate the security requirements of the information system.
• Verify and validate that the system meets the security requirements.
• Conduct comprehensive assessments of management, operational, and technical security controls.
• Execute and analyze network and systems to validate appropriate security control implementation.
• Develop security assessment plans and reports compliant with NIST standards.
• Adhere to the approved Security Assessment Plan (SAP) while executing security controls assessment.
• Collect and catalogue evidence of security controls assessment findings.
• Develop security assessment reports (SAR) detailing assessment findings with supporting evidence.
• Update system qualitative risk assessment reports (RAR) compliant with NIST SP 800-30.
• Develop recommendation reports aiding in Plan of Action and Milestone (POA&M) development.
• Develop security assessment executive summary documents.
• Enter assessment data into the Cyber Security Assessment and Management (CSAM) database.
• Provide presentations, reports, evaluations, reviews, meeting minutes, and working papers as requested.
• Apply MARAD/DOT A&A guidance and policy to achieve program objectives.
• Actively work with the designated Information Systems Security Manager (ISSM).
• Perform other job-related duties as assigned.

Qualifications

• Bachelor's Degree in Cybersecurity or related IT field may be substituted for 4 years of experience.
• Bachelor's Degree in an IT Related Field.
• Certified Information Systems Auditor (CISA), Advanced in AI Audit (AAIA), or equivalent certification.
• 12 years of related work experience.
• Prior experience supporting US Navy or Coast Guard Maritime Cyber Assessments.
• Prior Department of Transportation experience is a plus.
• Must pass pre-employment qualifications of Cherokee Federal.

Requirements

• Must possess or be able to obtain a Public Trust clearance.

Benefits

• Pay commensurate with experience.
• Full-time benefits include Medical, Dental, Vision, 401K, and other possible benefits.
• Benefits are subject to change with or without notice.