Rmf Assessor Jobs (NOW HIRING)

Security Assessor (RMF / GRC)

Location: Bethesda, MD (Hybrid; On-site as Required)

Clearance: Tier 2 Public Trust (Required)

Employment Type: Full-Time

Position Summary

Digital Global Connectors (DGC) is seeking an experienced Security Assessor (RMF / GRC) to support a Federal information security program. The Security Assessor is responsible for planning, conducting, documenting, and reporting comprehensive security control assessments that evaluate the effectiveness of administrative, technical, and operational safeguards protecting enterprise information systems.

This position performs Security Control Assessments (SCAs), validates implementation of NIST security controls, supports Authorization to Operate (ATO) activities, identifies cybersecurity risks, and develops recommendations to improve organizational security posture. The Security Assessor collaborates closely with ISSOs, Security Engineers, System Owners, Security Architects, Program Managers, and Government stakeholders to ensure systems meet Federal cybersecurity and compliance requirements.

The successful candidate will possess extensive experience performing Risk Management Framework (RMF) assessments, evaluating security controls, and producing assessment documentation that supports system authorization and continuous monitoring.

Essential Duties and Responsibilities Security Control Assessments

• Plan and conduct Security Control Assessments (SCAs) for enterprise information systems.
• Evaluate implementation of administrative, technical, and operational security controls.
• Assess the effectiveness of security controls using interviews, technical testing, documentation reviews, and observation.
• Validate implementation of corrective actions.
• Identify security deficiencies and associated risks.
• Develop risk-based recommendations for remediation.

Risk Management Framework (RMF)

• Support all phases of the Risk Management Framework (RMF).
• Assess implementation of NIST SP 800-53 security controls.
• Support Authorization to Operate (ATO), Authorization to Test (ATT), and reauthorization activities.
• Review System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms).
• Validate remediation of assessment findings.Support continuous monitoring activities throughout the system lifecycle.

Governance, Risk, and Compliance (GRC)

• Evaluate compliance with applicable Federal cybersecurity requirements, organizational policies, and security standards.
• Assess cybersecurity governance processes.
• Perform risk analyses supporting executive decision-making.
• Identify compliance gaps and recommend corrective actions.
• Assist organizations in improving overall cybersecurity maturity.
• Support enterprise GRC initiatives and reporting.

Technical Security Assessments

• Review system configurations for compliance with approved security baselines.
• Evaluate identity and access management controls.
• Assess cloud security implementations.
• Validate vulnerability remediation activities.
• Review audit logging, incident response, contingency planning, and configuration management practices.
• Assess secure implementation of enterprise cybersecurity technologies.

Documentation Review

Review and evaluate:

• System Security Plans (SSPs)
• Security Assessment Plans (SAPs)
• Security Assessment Reports (SARs)
• Plans of Action and Milestones (POA&Ms)
• Configuration Management Plans
• Contingency Plans
• Incident Response Plans
• Privacy Documentation
• Continuous Monitoring Strategies
• Security Architecture Documentation

Ensure documentation is complete, accurate, and compliant with applicable Federal standards.

Assessment Reporting

Develop and maintain:

• Security Assessment Plans
• Security Assessment Reports
• Executive Assessment Summaries
• Risk Assessments
• POA&M Recommendations
• Continuous Monitoring Reports
• Compliance Assessments
• Control Implementation Analyses
• Technical Findings Reports
• Standard Operating Procedures

Prepare clear, accurate, and actionable reports suitable for both technical and executive audiences.

Collaboration

• Coordinate with ISSOs, Security Engineers, Security Architects, System Owners, Program Managers, Cloud Engineers, SOC personnel, and Government stakeholders.
• Participate in assessment planning meetings and technical working groups.
• Provide assessment briefings to leadership.
• Support remediation planning and validation activities.
• Assist organizations in preparing for audits and authorization reviews.

Continuous Improvement

• Monitor updates to Federal cybersecurity policies, standards, and assessment methodologies.
• Recommend improvements to assessment processes and governance practices.
• Support automation of assessment and compliance activities where appropriate.
• Share assessment best practices across project teams.
• Maintain professional certifications and technical expertise.

Minimum Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Engineering, or a related discipline.
• Minimum five (5) years of experience performing cybersecurity assessments, RMF activities, or Governance, Risk, and Compliance (GRC) functions.
• Experience conducting Security Control Assessments (SCAs) using NIST SP 800-53.
• Experience supporting Authorization to Operate (ATO) activities and continuous monitoring programs.
• Familiarity with NIST Risk Management Framework (RMF), FISMA, and Federal cybersecurity requirements.
• Strong analytical, documentation, technical writing, and communication skills.
• U.S. Citizenship required.
• Ability to obtain and maintain a Tier 2 Public Trust.

Preferred Qualifications

• Master's degree in Cybersecurity, Information Assurance, Information Systems, Engineering, or a related discipline.
• Experience supporting a Federal civilian agency.
• Experience assessing cloud-hosted information systems.
• Experience supporting enterprise Governance, Risk, and Compliance (GRC) programs.
• Certified Authorization Professional (CAP)
• Certified Information Systems Auditor (CISA)
• Certified Information Security Manager (CISM)
• Certified Information Systems Security Professional (CISSP)
• Certified in Risk and Information Systems Control (CRISC)
• ISC2 CGRC (Certified in Governance, Risk and Compliance) (preferred)

Knowledge, Skills, and Abilities

• Risk Management Framework (RMF)
• Governance, Risk, and Compliance (GRC)
• Security Control Assessments (SCAs)
• Authorization to Operate (ATO)
• NIST SP 800-53
• NIST SP 800-37
• Federal Information Security Modernization Act (FISMA)
• Continuous Monitoring
• System Security Plans (SSPs)
• Security Assessment Reports (SARs)
• Security Assessment Plans (SAPs)
• Plans of Action and Milestones (POA&Ms)
• Risk Assessments
• Security Documentation Review
• Cloud Security Assessments
• Identity and Access Management (IAM)
• Vulnerability Management
• Security Compliance
• Audit Support
• Technical Writing
• Microsoft Office Suite
• ServiceNow
• Jira

Security Requirements

• Ability to successfully obtain and maintain a Tier 2 Public Trust investigation.
• Compliance with all applicable Federal security, privacy, ethics, and information assurance training requirements before receiving system access.
• Ability to support security assessments, authorization activities, audits, continuity of operations (COOP), emergency response activities, and surge support as required.
• Must maintain strict confidentiality while handling assessment documentation, risk analyses, security findings, compliance records, and Federal information systems.
• Ability to independently evaluate security controls, identify cybersecurity risks, communicate assessment results to technical and executive stakeholders, and support the authorization and continuous monitoring of enterprise information systems through objective, risk-based security assessments.