This position requires an active Public Trust clearance or the ability to obtain a Public Trust clearance to be considered.

Position Summary

Assess information systems in one of three states: System Authorization: Initial Authorization, Reauthorization, or Continuous Monitoring Assessment (CMA), also known as ongoing authorization. The Independent Assessor must be prepared to support the process within each of these three Authorization states.

Compensation & Benefits

Starting Salary Range for Senior Security Controls Assessor: $150,000 – $160,000

Benefits That Set Us Apart

When considering your next opportunity, compensation is only part of the picture. We offer a benefits package designed to invest in your future and support your life outside of work.

Highlights include

Up to a 6% 401(k) company match to help you build long-term financial security
Paid time off as part of our comprehensive benefits package, so you have the flexibility to rest, recharge, and enjoy what matters most
Medical, dental, and vision insurance, plus prescription drug coverage
Basic life and AD&D insurance, with supplemental life options
Short-term and long-term disability coverage
Paid holidays
Employee Assistance Program (EAP)
Flexible Spending Account (FSA) and Health Savings Account (HSA) options
Professional development, training, and certification support
Voluntary benefits including accident, critical illness, and identity theft protection

Because taking care of our employees isn’t just a promise, it’s part of who we are.

Benefits are subject to change and eligibility requirements apply.

Essential Functions, Duties & Responsibilities

Includes the following

Provide annual assessment support for the NSMV and MARAD Office of the Chief Information Officer (OCIO) programs.
Conduct independent assessments of specified MARAD information systems following the System Authorization process as defined in the current DOT Security Authorization and Continuous Monitoring Performance Guide and associated templates.
Review existing information system core documentation including privacy requirements data to support development of security assessment plans and schedules support authority to operate (ATO) dates.
Provides identification of non-compliance of security requirements and possible mitigations to requirements that are not in compliance
Verifies and validates that the system meets the security requirements
Conduct independent, comprehensive assessments of management, operational, and technical security controls and control enhancements within IT systems to determine overall effectiveness.
Execute and conduct analysis of network and systems to validate appropriate security control implementation.
Deliverables
Develop security assessment plans and assessment reports compliant with latest revisions of NIST Special Publication 800-53A Recommended Security Controls for Federal Information Systems and Organizations and NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems.
Develop Security Assessment Plan (SAP) detailing assessment scope with clarity, specifying scope exclusions, if necessary, controls being assessed, methods of performing assessment including sampling and “determine if” statements, notional schedule, assessment staff members, inventory of targeted system endpoints/components and software, processes, status of account of system specific, hybrid and inherited controls.
The Assessor must adhere to the approved SAP while executing security controls assessment against targeted information system(s).
Develop security assessment report (SAR) in accordance with scope and schedule defined in the SAP. SAR must detail assessment findings of controls assessed with supporting evidence substantiating claims.
Develop / update system qualitative risk assessment reports (RAR) compliant with NIST SP 800-30 Guide for Conducting Risk Assessments.
Develop recommendation report aiding in Plan of Action and Milestone (POA&M) development. Recommendation report would detail findings and applicable actions and effort to be considered for remediation.
Develop security assessment executive summary documents including summative presentation further providing an overview of activities, findings, risks and mitigation recommendations.
Enter assessment data the Cyber Security Assessment and Management (CSAM) database, the ATO system of record used by DOT.
Provide presentations, reports, evaluations, reviews, meeting minutes and working papers in support of all tasks as requested by the COR.
Apply MARAD/DOT A&A guidance and policy to achieve the program objectives and enhancing the overall quality of packages for receiving an ATO

Stakeholder Collaboration and Guidance

Actively work with the designated Information Systems Security Manager ISSM, information system owners, technical leads, and other stakeholders throughout the process.
Provide final security assessment support and guidance regarding vulnerability remediation and determination of the overall risk posture.
Coordinate technical meetings, prioritize topics, and identify objectives to support A&A package development and ensure timely program completion.
Maintain thorough and current knowledge of A&A processes, standards, and industry best practices, including the NIST Special Publication 800 series.
Knowledge of current industry methods for evaluating, implementing, and disseminating information technology (IT) security assessment, monitoring, detection, and remediation tools and procedures utilizing standards-based concepts and capabilities.
Knowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data.
Knowledge of the Security Assessment and Authorization process.
Knowledge of information technology (IT) security principles and methods (e.g., firewalls, demilitarized zones, encryption).
Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).
Skill in discerning the protection needs (i.e., security controls) of information systems and networks.
Skill in determining how a security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomes.
Knowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.
Knowledge of Risk Management Framework (RMF) requirements.
Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins
Knowledge of penetration testing principles, tools, and techniques.
Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code)
Perform other job-related duties as assigned.

Supervisory Responsibilities

No supervisory/management authority

Basic Qualifications

Bachelor’s Degree in an IT Related Field.
Certified Information Systems Auditor (CISA), Advanced in AI Audit (AAIA), or equivalent certification
12 years of related work experience
Prior experience supporting Maritime Cyber Assessments
Must be a US Citizen.
This position requires an active Public Trust clearance or the ability to obtain a Public Trust clearance to be considered.
Prolonged periods of sitting at a desk and working on a computer; may occasionally require standing or moving about the office for extended periods.
Must pass pre-employment qualifications of Cherokee Federal.

Work Environment

Work is performed primarily in a climate-controlled environment.

Legal Disclaimer

All qualified applicants will receive consideration for employment without regard to protected veteran status, disability or any other status protected under applicable federal, state or local law.

Many of our job openings require access to government buildings or military installations. Candidates must pass pre-employment qualifications of Cherokee Federal.

In compliance with Washington D.C.’s Wage Transparency Act, the estimated annual salary range for this position is $150,000 – $160,000. Actual compensation is based on qualifications and experience.

Equal Employment Opportunity (EEO) Statement

Cherokee Federal is a federal contractor subject to the Vietnam Era Veterans’ Readjustment Assistance Act (VEVRAA). As required by VEVRAA, we take affirmative action to employ and advance in employment qualified protected veterans. Protected veterans are encouraged to self-identify during the application process.

Cherokee Federal takes affirmative action to employ and advance in employment qualified individuals with disabilities in compliance with Section 503 of the Rehabilitation Act. Qualified individuals with disabilities are encouraged to self-identify during the application process.

Reasonable accommodations are available to qualified individuals with disabilities or those with sincerely held religious beliefs. To request an accommodation in the application or interview process, please contact Human Resources at [email protected].

This position is subject to pre-employment drug testing. Cherokee Federal maintains a drug-free workplace in accordance with applicable federal and state laws and regulations.

This position may be contingent upon the successful completion of a background investigation. The scope of the investigation will be commensurate with position requirements and applicable law.

Senior Security Controls Assessor @ Cherokee Federal

About this role