The posting
Everforth ECS is seeking a highly experienced Cybersecurity Assessor – Level 3 to join an enterprise-scale cybersecurity program supporting a major federal civilian agency. This position supports remote work, with preference given to candidates residing in or near the National Capital Region (NCR).
In this role, you will lead complex cybersecurity security control assessments, evaluate enterprise security risks, and provide senior-level expertise supporting federal cybersecurity compliance and authorization activities. You will work closely with cybersecurity leadership, ISSOs, system owners, security engineers, and government stakeholders to plan and execute comprehensive assessments, validate security control effectiveness, and develop actionable recommendations addressing significant security weaknesses. Your contributions will strengthen assessment quality, improve risk-based decision-making, and advance continuous monitoring and security assurance capabilities across mission-critical federal systems and services.
Please Note: This position is contingent upon contract award.
Salary Range: $120,000 - $133,000
Position Responsibilities
- Lead complex cybersecurity security control assessments across enterprise information systems, applications, cloud environments, and supporting infrastructure to evaluate security effectiveness and compliance with federal requirements.
- Plan and coordinate security assessments, including defining assessment scope, selecting methodologies, establishing testing procedures, and identifying evidence requirements in accordance with NIST SP 800-53A and the NIST Risk Management Framework (RMF).
- Evaluate the design, implementation, and effectiveness of technical, operational, and management security controls, identifying systemic weaknesses, control gaps, and significant cybersecurity risks.
- Lead technical assessment activities involving system configurations, security architectures, cloud services, access controls, vulnerability management, and continuous monitoring capabilities.
- Review and validate assessment evidence, technical findings, risk ratings, and supporting documentation to ensure accuracy, consistency, and defensibility.
- Develop and review comprehensive Security Assessment Reports (SARs), risk assessments, and supporting authorization artifacts that communicate findings, potential impacts, and recommended corrective actions.
- Provide senior-level assessment expertise to ISSOs, system owners, cybersecurity engineers, and government stakeholders regarding security control requirements, assessment findings, and remediation priorities.
- Support Authority to Operate (ATO) and ongoing authorization processes by evaluating security control effectiveness, identifying residual risks, and providing technical assessment results to designated authorization officials.
- Evaluate remediation plans and POA&M activities, prioritize reassessment efforts, and validate corrective actions addressing significant security control deficiencies.
- Lead assessment quality reviews, develop standardized assessment methodologies, and recommend improvements to evidence collection, control testing, reporting, and risk evaluation practices.
- Coordinate with cybersecurity operations, vulnerability management, security engineering, and compliance teams to incorporate relevant technical findings and continuous monitoring information into assessment activities.
- Mentor junior and mid-level assessors, provide technical guidance on complex assessments, and communicate significant security risks and recommended improvements to cybersecurity leadership and government stakeholders.
- U.S. Citizenship required.
- Remote position, with preference for candidates residing within close proximity to the National Capital Region (NCR).
- Active Public Trust 6C determination, or the ability to obtain and maintain the required determination.
- Bachelor Degree and 5 years of experience, Master's Degree and 3 years of experience or a Phd and 0 years of experience in Cybersecurity, Information Technology, Information Systems, Computer Science, Engineering, or a related field (or equivalent professional experience).
- 7+ years of relevant experience in cybersecurity assessments, security control evaluation, risk management, information system security, or federal cybersecurity compliance.
- Demonstrated experience leading complex security control assessments, developing assessment methodologies, evaluating technical evidence, and producing comprehensive assessment findings.
- Advanced knowledge of federal cybersecurity requirements, including FISMA, NIST SP 800-53, NIST SP 800-53A, NIST SP 800-37, and the NIST Risk Management Framework (RMF).
- Strong understanding of enterprise security architectures, cloud security, network security, identity and access management, vulnerability management, and technical security control implementation.
- Extensive experience supporting security authorization activities, evaluating security risks, reviewing SSPs and SARs, and assessing remediation activities and POA&Ms.
- Strong technical leadership, analytical, risk assessment, documentation, and communication skills, with demonstrated ability to guide assessment personnel and communicate complex security findings to senior stakeholders.
