Security Controls Assessor - Senior

Cherokee Federal provides federal contracting services focused on supporting government missions. The Senior Security Controls Assessor independently evaluates MARAD information systems and security controls under the NIST Risk Management Framework, supports authorization and continuous monitoring activities, develops assessment documentation, and collaborates with cybersecurity stakeholders on compliance and risk mitigation.

Responsibilities:

• Assess MARAD systems in one of three states: Initial Authorization, Reauthorization, or Continuous Monitoring Assessment (CMA), also known as ongoing authorization. The Independent Assessor must be prepared to support each of these three authorization states
• Provide annual assessment support to the NSMV and MARAD CIO programs. NSMV assessment support will involve conducting on-site evaluations at the Philadelphia shipyard and other locations
• Conduct independent assessments of specified MARAD information systems following the System Authorization process defined in the current DOT Security Authorization and Continuous Monitoring Performance Guide and associated templates
• Review existing information-system core documentation, including privacy requirements and data, to support the development of security assessment plans and schedules supporting Authority to Operate (ATO) dates
• Review and establish annual assessment schedules in support of required deliverables and artifacts
• Identify noncompliance with security requirements and recommend possible mitigation strategies
• Validate the security requirements of information systems
• Verify that systems meet applicable security requirements
• Conduct independent and comprehensive assessments of management, operational, and technical security controls and control enhancements to determine their overall effectiveness
• Execute and analyze network and system assessments to validate appropriate security-control implementation
• Develop Security Assessment Plans and Security Assessment Reports compliant with the latest revisions of NIST Special Publication 800-53A, Assessing Security and Privacy Controls in Information Systems and Organizations, and NIST SP 800-37, Risk Management Framework for Information Systems and Organizations
• Develop Security Assessment Plans (SAPs) that clearly define the assessment scope, exclusions when necessary, controls being assessed, assessment methods, sampling methods, “determine if” statements, proposed schedules, assessment staff, targeted system endpoints and components, software inventories, processes, and the status of system-specific, hybrid, and inherited controls
• Follow the approved SAP when assessing security controls for targeted information systems
• Use approved techniques to collect and catalog supporting evidence, including documents, screenshots, scanning reports, and interview notes, to substantiate security-control implementation findings
• Develop Security Assessment Reports (SARs) according to the scope and schedule defined in the SAP. The SAR must document assessment findings and include evidence supporting the implementation status of each assessed control
• Develop and update qualitative Risk Assessment Reports (RARs) compliant with NIST SP 800-30, Guide for Conducting Risk Assessments
• Develop recommendation reports supporting Plan of Action and Milestones (POA&M) development. Reports must document findings and recommend actions and levels of effort for remediation
• Develop executive-summary documents and presentations that provide an overview of assessment activities, findings, risks, and mitigation recommendations
• Enter assessment data into the Cyber Security Assessment and Management (CSAM) database, DOT’s system of record for ATOs
• Provide presentations, reports, evaluations, reviews, meeting minutes, and working papers supporting all assigned tasks, as requested by the Contracting Officer’s Representative (COR)
• Apply MARAD and DOT Assessment and Authorization guidance and policies to achieve program objectives and improve the overall quality of ATO packages
• Collaborate actively with the designated Information Systems Security Manager (ISSM)
• Perform other job-related duties as assigned

Requirements:

• Bachelor's degree in Cybersecurity or a related IT field may be substituted for four years of experience
• Bachelor's degree in an IT-related field
• Certified Information Systems Auditor (CISA), Advanced in AI Audit (AAIA), or an equivalent certification
• Twelve years of related work experience
• Prior experience supporting U.S. Navy or Coast Guard maritime cybersecurity assessments
• Must possess or be able to obtain a Public Trust clearance
• Prior Department of Transportation experience is a plus