Senior Security Control Assessor

Description

Tharros supports the Department of Homeland Security (DHS) with cybersecurity services across its Intelligence Enterprise.

In support of this mission, we have an immediate opportunity for a Senior Security Control Assessor . In this role you will lead the most complex assessments in the portfolio, including Cross Domain Solutions (CDS), Special Access Program (SAP) systems, C-LAN extension sites, and cloud environments. You will guide junior assessors, improve A&A standard operating procedures, and help modernize the authorization process toward ongoing authorization and reciprocity. This position is on-site in a Government SCIF in Washington, DC.

• BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 10 years' experience in IT or cybersecurity.
• Minimum of 7 years' experience in RMF security control assessment.
• Active TS/SCI clearance and U.S. citizenship; willingness to undergo a DHS counterintelligence-scope polygraph.
• Knowledge of ICD 503, CNSSI 1253, and the Risk Management Framework (RMF).
• Knowledge of Cross Domain Solution or SAP system assessment requirements.
• Knowledge of cloud security authorization concepts.
• Skill in using at least two security tools (e.g., Nessus/ACAS, SCAP, WebInspect, SonarQube, STIG Viewer).
• Skill in developing and improving assessment procedures and SOPs.
• Ability to lead complex assessments and mentor junior staff.
• Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.
• Excellent written and oral communications skills.

Requirements

• Active Top Secret clearance with contingency on DOD CAS granting SCI eligibility.
• Requires 7-10 years related experience.
• Must be able to assess the security controls employed within and inherited by an information system using assessment procedures specified in the security assessment plan.
• Must be able to provide specific recommendations on how to correct weaknesses or deficiencies in the controls and address identified vulnerabilities.
• Excellent written and verbal communication skills.
• Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.