Subject Matter Expert (SME) Cybersecurity Consultant - Control Testing

Position Summary

The SME Cybersecurity Consultant will play a critical role in conducting, guiding, and validating control testing efforts for federal and critical industry clients. This individual will leverage 10+ years of experience in cybersecurity, with a focus on compliance, control assessments, and risk management. The ideal candidate will be a recognized expert in NIST 800-53, NIST 800-37, and FISMA, with strong analytical and communication skills to support high-profile engagements.

Key Responsibilities

• Lead and perform comprehensive cybersecurity control assessments in accordance with NIST 800-53 v5 , NIST 800-37 , and FISMA requirements .
• Serve as the subject matter expert (SME) for control testing methodologies, providing guidance and mentorship to assessment teams.
• Review and validate control implementation and effectiveness, ensuring compliance with federal regulations and organizational policies.
• Develop and deliver key artifacts, including System Security Plans (SSPs), Security Assessment Reports (SARs), and Plan of Action and Milestones (POA&Ms).
• Analyze security documentation, configurations, and evidence to assess compliance with security and privacy controls.
• Collaborate with cross-functional teams, including IT, security, and audit teams, to identify, document, and mitigate risks.
• Provide technical expertise in the implementation of the Risk Management Framework (RMF) process, supporting system authorization and accreditation.
• Assist in the preparation for audits, inspections, and other regulatory assessments, ensuring successful outcomes.
• Stay informed about evolving federal cybersecurity regulations, standards, and threats to provide proactive recommendations.
• Communicate assessment findings and recommendations effectively to both technical and non-technical stakeholders, including senior leadership and government clients.

Qualifications

Required Experience and Skills:

• MUST BE A U.S. CITIZEN
• 10+ years of experience in cybersecurity, with a strong focus on control testing and compliance in federal environments.
• In-depth knowledge of NIST 800-53 v5 , NIST 800-37 , and FISMA frameworks and requirements.
• Proven expertise in conducting control assessments, documenting findings, and developing remediation plans.
• Strong understanding of the Risk Management Framework (RMF) process and its application to federal systems.
• Experience in developing security artifacts, including SSPs, SARs, and POA&Ms.
• Exceptional analytical skills, with the ability to assess complex systems and identify compliance gaps.
• Excellent verbal and written communication skills, with experience briefing senior executives and federal clients.
• Bachelor’s degree in Cybersecurity, Information Technology, or a related field.

Preferred Qualifications:

• Certifications such as CISSP , CAP , CISM , or CRISC .
• Experience in privacy control assessments and integrating privacy requirements into security programs.
• Familiarity with cybersecurity tools and technologies used for testing and validation.