Security Control Assessor

ResponsibilitiesPeraton seeks a Cloud Security Control Assessor to support the Army Cyber Command (ARCYBER). Location: Alexandria, VA/Metro Park near Fort Belvoir, VA.Tasks include:Conduct assessments and facilitate risk mitigation planningProvide Assessment and Authorization (A&A) for the ARCYBER cloud infrastructureExecute a security control assessment plan and update the System Security PlanReview vulnerability scans and remediationImplement risk management programs by utilizing NIST, FISMA, HIPAA, and PII -- and document solutionsMonitor the privacy landscape regarding all data (privacy, protection, classification, and residency)Assist clients with identifying gaps within existing privacy programs and designing solutions to help address those challengesScan, test, and validate systems/networks/applications to obtain/maintain an ATO under NIST/FISMA guidelinesQualificationsRequired:Minimum experience of 12 years with BS/BA; Minimum of 10 years with MS/MA; Minimum of 7 years with Ph.D. Will consider HS+16 or Associates +14.Must have current IAM level III certification (such as CISM)Must have knowledge of enterprise solutions across multiple cloud operating environments (JWICS, SIPRNET, NIPRNET, and commercial Internet)Must have eMASS, ACAS, and ISC2 Certified Cloud Computing Professional (CCSP) or CompTIA Cloud+ experienceMust have knowledge in the following areas:Knowledge of computer networking and/or cloud computing concepts and protocols, and network security methodologiesKnowledge of cyber threats and vulnerabilities in a virtualized environment.Knowledge of cybersecurity principlesKnowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurityKnowledge of risk management framework processes (e.g., methods for assessing and mitigating risk)Knowledge of specific operational impacts of cybersecurity lapsesKnowledge of industry methods for evaluating, implementing, and disseminating Information Technology (IT) security assessment, monitoring, detection, and remediation tools and procedures using standards-based concepts and capabilitiesKnowledge of cyber defense and vulnerability assessment tools, including opensource tools, and their capabilitiesKnowledge of cybersecurity principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation)Knowledge of cybersecurity principles used to manage risks related to the use, processing, storage, and transmission of information or data in a cloud environmentKnowledge of IT and cloud computing security principles and methods (e.g., firewalls, demilitarized zones, encryption)Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletinsKnowledge of network and/or cloud computing environment security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth)Knowledge of organization's evaluation and validation requirementsKnowledge of penetration testing principles, tools, and techniquesKnowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.Knowledge of Risk Management Framework (RMF) requirementsKnowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return oriented attacks, malicious code)Knowledge of the Security Assessment and Authorization processSkill in determining how a security and/or cloud computing security system should work (including its resilience and dependability capabilities) and how changes in conditions, operations, or the environment will affect these outcomesSkill in discerning the protection needs (i.e., security controls) of information systems and networks and those relating to cloud computingKnowledge of IT supply chain security and risk management policies, requirements, and proceduresKnowledge of local specialized system requirements (e.g., critical infrastructure systems that may not use standard IT) for safety, performance, and reliabilityKnowledge of new and emerging IT and cybersecurity technologies and/or those technologies specific to cloud computingKnowledge of organization's enterprise and/or cloud computing information security architecture systemKnowledge of Personal Identifiable Information (PII) data security standardsKnowledge of Personal Health Information (PHI) data security standardsActive TS clearance with ability to obtain/maintain SCIU.S. Citizenship RequiredPeraton OverviewPeraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure.Target Salary Range$146,000 - $234,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual’s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.EEOEEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.Job SummaryRequisition ID: 2026-169396Position Category: Information TechnologyClearance: Top Secret/SCI