security control assessor

BayOne Solutions

<div>
 
 
 Position: Cyber Security Control Assessor
 
 
 
 
 Location: Oakland, CA (Hybrid)
 
 
 
 
 Duration: Long Term Contract
 
 
 
 
 
 
 
 Duties and Responsibilities
 
 
 
 &bull; Perform multi-platform (application, database, operating system, middleware, monitoring tools, and business processes) level assessments based on predefined test objectives and test plans. Perform retest of controls that have been remediated or updated as a result of previously identified deficiencies.
 
 
 Obtain, review, and interpret evidence provided to validate controls are performed effectively.
 
 
 &bull; Execute and report on results of IT Compliance assessments in accordance with industry best practices and established regulatory standards and requirements (e.g., NIST SP800-53, SP800-115, SOX, NERC CIP).
 
 
 &bull; Obtain, review, and interpret organizational IT policies, standards and procedures to identify control points that would assist in mitigating risk to the business.
 
 
 &bull; Review test results or interpret evidences to address vulnerabilities, gaps, or control deficiencies; work with stakeholders to establish plans for sustainable resolution.
 
 
 &bull; Identify risks associated with control failures and supports the identification of mitigating controls
 
 
 &bull; Partner with control owners to ensure control documentation is updated periodically to reflect current control environment
 
 
 &bull; Perform other tasks as necessary to ensure that the Compliance meets its commitments to customers
 
 
 &bull; Support the Compliance Sr. Manager/Manager as needed.
 
 
 
 
 
 
 Minimum Education Required:
 
 
 
 &bull; BA/BS in Computer Science, Business, or equivalent experience.
 
 
 Minimum On-the-Job Experience
 
 
 &bull; Minimum of 3 years of general IT experience, including IT security or IT risk management experience
 
 
 &bull; Experience using Excel worksheets, workbooks, and formulas
 
 
 &bull; Experience managing multiple projects with conflicting priorities
 
 
 
 
 
 
 Minimum Required License / Certification:
 
 
 
 At least one existing certification from the following list, which must be currently maintained and valid: certification:
 
 
 &bull; Cisco Certified Networking Associate (CCNA)
 
 
 &bull; Certified Information Systems Auditor (CISA);
 
 
 &bull; Certified in Risk and Information System Control (CRISC);
 
 
 &bull; Certified Internal Auditor (CIA);
 
 
 &bull; Certified Information Systems Security Professional (CISSP);
 
 
 
 
 
 
 Knowledge, Skills, and Abilities
 
 
 
 &bull; Strong oral and written communication skills
 
 
 &bull; Strong analytical skills
 
 
 &bull; Understanding of application, database, network and systems security
 
 
 &bull; Understanding of general computing controls (GCCs)
 
 
 &bull; Able to identify complex control gaps.
 
 
 &bull; Understanding of generally applicable and accepted auditing standards and framework (e.g. COBIT) and best practices for IT services management (e.g., ITIL), regulatory standards and requirements (e.g. Sarbanes Oxley Act, NERC/CIP)
 
 
 &bull; Excellent planning, organizational, and project management skills
 
 
 &bull; Able to multi-task projects or assessments
 
 
 &bull; Ability to work with minimal supervision in a fast-paced environment
 
 
 &bull; Detail oriented
 
</div>

Cyber Security Analyst

E-INFOSOL LLC

<div>E-INFOSOL LLC is seeking a highly motivated Senior Cloud Security Assessor to be a Full-time employee in Washington, DC. Come join a team that collaborates across the entire organization to bring the right solution to our customers and drive innovation.
Job Description:
The Senior Cloud Security Assessor will be responsible for developing secure configurations of cloud services to ensure resources are deployed in compliance with framework security controls.
Responsibilities:<ul><li>
Leads and assists in the delivery of cyber security and IT security engineering projects.</li><li>
Research cloud service documentation to outline secure configurations and potential risks associated with each service.</li><li>
Assess the risk posture and exposure of misconfigured services.</li><li>
Develop guardrails to ensure services are deployed in a secure configuration.</li><li>
Deploy cloud resources using both the web interface and command line utilities.</li><li>
Gather information about the service and resources using CSP commands to return relevant security settings.</li><li>
Evaluate and recommend security software/hardware and its integration into existing architecture.</li><li>
Create security matrix checks from the aforementioned security configurations.</li><li>
Apply the appropriate security controls to the checks from the required compliance framework.</li><li>
Create severity levels for checks using the Common Vulnerability Scoring System (CVSS 3.1)</li><li>
Conduct peer reviews for additional matrix checks</li><li>
Perform releases in a git environment.</li></ul>
Required Experience:<ul><li>
5+ years in a cloud environment</li><li>
Experience leading security design and architecture reviews of large applications, systems, and networks.</li><li>
Experience with Linux, Windows, networking, firewalls, and general hands-on administration/engineering experience.</li><li>
Scripting skills and understanding of basic variables, loops, arrays, and functions.</li><li>
A track record of success in securing large and complex environments, such as data centers or other industrial spaces.</li></ul>
Required Technologies/Languages:<ul><li>
Cloud/virtual</li><li>
Bash</li><li>
PowerShell</li><li>
Python</li><li>
CSP command line interface</li><li>
Json</li><li>
jmespath</li><li>
XML</li></ul>
Certifications: (Preferred)<ul><li>
AWS, Azure, GCP, OCI, Associate or higher, CISSP, Security +, FISMA, NIST</li></ul>
Education: (Preferred)<ul><li>
Bachelor&rsquo;s degree in computer science</li></ul>
Clearance:<ul><li>
Must be a US Citizen with an Active Top-Secret Clearance with SCI eligibility</li></ul>
About E-INFOSOL
E-INFOSOL is a Service Disabled and Veteran Owned Small Business (SDVOSB) located in the Washington, D.C. metropolitan area. We specialize in building modern and tailored solutions to support our customers&rsquo; mission. As a mission-first organization, we deliver Subject Matter Expertise (SME) in cloud computing, virtualization, cyber security, software development and data services. We support the Intelligence Community, Department of Defense, Federal Law Enforcement, Civilian Agencies and the Private Sector.
Through strategic partnerships with top industry players such as Amazon Web Services (AWS), VMware, Microsoft and Nutanix, E-INFOSOL provide an array of IT products and solutions. Combined with our industry expertise, we deliver in-depth knowledge on Government requirements and fully understand NIST and DoD security requirements. Our expertise in the latest technologies combined with our understanding of infrastructure needs and security requirements provides the best combination for achieving innovative and secure environments for Government Agencies and Private Sector.
Career Growth
&ldquo;Putting People First, Achieving our Mission Together&rdquo;. E-INFOSOL is a people-first organization focusing on a positive employee culture that inspires creativity and innovation in support of our customers. With opportunities such as reimbursement and bonuses based on completion of certifications, we invest in our employees&rsquo; career growth.
Benefits<ul><li>
Medical &ndash; 100% company paid premiums for employees with dependent options.</li><li>
Dental and Vision</li><li>
Retirement Savings (401k) up to 4% match</li><li>
Health Savings Account (HSA), FSA and DCFSA</li><li>
Company-paid Short/Long-term disability (w/ additional supplemental options)</li><li>
Company-paid Life and AD&amp;D (w/ additional supplemental options)</li><li>
Generous Paid Time Off and ALL 11 Federal Holidays</li><li>
Legal and Identity Protection Services</li><li>
Bonuses for certifications and reimbursement</li><li>
Employee Perks:</li><li>
UberOne, Company Outings (Sporting events, Happy Hours, etc.), Discounts on services including Pet Insurance</li></ul>
Company Awards<ul><li>
SBA 8(a) Certified</li><li>
SDVOSB</li><li>
GSA Contract Holder</li><li>
Inc. 5000</li></ul>
Equal Employment Opportunity Policy
E-INFOSOL LLC provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws.
This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation, and training.
Website: E-INFOSOL.com
PID: 26-09P-03-001</div>

Cloud Security Assessor

PingWind Inc.

<div><div>Location: Alexandria, Va 
Required Clearance: Top Secret Clearance 
Certifications: Holds senior-level cybersecurity certifications appropriate for ISSO and RMF roles, such as CISSP, CAP, CISM, or equivalent DoD 8570/8140-approved cybersecurity certifications. 
Required Education: BS/BA degree 
Required Experience: 10 years relevant experience (an additional 4 years experience may be substituted in lieu of degree). 

Position Description:

PingWind is seeking an Information System Security Officer (ISSO) responsible for overseeing system-level cybersecurity compliance, assessment coordination, and continuous monitoring activities to ensure MODES III information systems maintain authorization and operate in accordance with DoD and MC&amp;FP cybersecurity requirements.

Responsibilities:
<ul><li>Serves as the senior ISSO supporting MODES III systems, managing day-to-day security compliance activities in accordance with NIST RMF and DoD cybersecurity policies per.</li><li>Coordinates and supports Security Control Assessor (SCA) activities, including assessment planning, evidence collection, remediation tracking, and closure of findings. (SCA Management).</li><li>Oversees implementation and validation of technical, management, and operational security controls, ensuring systems remain compliant throughout their lifecycle.</li><li>Manages continuous monitoring activities, including review of vulnerability data, configuration baselines, and control effectiveness to support ongoing authorization.</li><li>Develops, reviews, and maintains RMF artifacts, including SSPs, POA&amp;Ms, security assessment reports, and authorization packages.</li><li>Supports cybersecurity reporting, audits, and inspections by providing accurate compliance status, risk assessments, and mitigation updates to Government stakeholders.</li></ul>

Required Qualifications:
<ul><li>Top Secret Clearance</li><li>Holds senior-level cybersecurity certifications appropriate for ISSO and RMF roles, such as CISSP, CAP, CISM, or equivalent DoD 8570/8140-approved cybersecurity certifications.</li></ul>

Desired Qualifications
<ul><li>Master&rsquo;s Degree</li></ul>
<div>
About PingWind</div>
<div></div>
<div>PingWind is focused on delivering outstanding services to the federal government. We have extensive experience in the fields of cybersecurity, development, IT infrastructure, supply chain management and other professional services such as system design and continuous improvement. PingWind is an SBA certified Service-Disabled Veteran-Owned Small Business (SDVOSB) with offices in Northern Virginia and Huntsville AL.</div>
<div>www.PingWind.com</div>
<div></div>
<div>Our benefits include:</div>
<div></div>
<ul><li>Eleven Federal Holidays</li></ul>
<ul><li>Paid Time Off accrued each pay period</li></ul>
<ul><li>Parental Leave</li></ul>
<ul><li>Three medical plan choices with generous employer contribution</li></ul>
<ul><li>Dental and Vision Insurance</li></ul>
<ul><li>Company paid Short-Term and Long-Term Disability</li></ul>
<ul><li>Company paid Life and AD&amp;D Insurance</li></ul>
<ul><li>401k with competitive matching and vesting schedule</li></ul>
<ul><li>Continuing education assistance</li></ul>
<ul><li>Short Term / Long Term Disability &amp; Life Insurance</li></ul>
<ul><li>Medical, Dependent Care and Commuter Flexible Spending Accounts</li></ul>
<ul><li>Employee Assistance Program</li></ul>
<ul><li>Wellness benefits include Calm Health app and WellHub gym subsidy (formerly GymPass)</li></ul>
<ul><li>529 College Savings Plan</li></ul>
<ul><li>Legal Insurance</li></ul>
<ul><li>Pet Insurance</li></ul>
<div></div>
<div>Veterans are encouraged to apply</div>
<div></div>
<div>PingWind, Inc. does not discriminate in employment opportunities, terms, and conditions of employment, or practices on the basis of race, age, gender, religious or political beliefs, national origin or heritage, disability, sexual orientation, or any characteristic protected by law.</div>
</div>
We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.</div>

Information System Security Officer (ISSO)

Sumaria Systems

<div>Job Title: Information System Security Officer (ISSO)
Job Description:
Provide network architecture support for government systems IAW the Open Systems Interconnection (OSI) model, open protocols and Department of Defense Architecture Framework (DoDAF). The Contractor shall provide technical, advisory and draft documentation support for the development of DoDAF views for MQ-9, GCS, and network data flows extending to downstream customers. The Contractor shall make recommendations regarding potential enhancements for Government consideration.
Provide support by assessing the performance of networked and integrated systems, subsystems and equipment extending from the sensor platform to the end user human machine interface. The Contractor shall identify potential issues and make recommendations for Government consideration.
Perform analysis required to integrate subsystems and software applications to include, and is not limited to, SWaP, electromagnetic compatibility, interoperability and associated commercial and military standards compliance, information assurance and multi-level security considerations. The Contractor shall identify potential issues and make recommendations for Government consideration.
Review and provide inputs to applicable military and commercial standards initiatives relating to responsibilities within the program
Responsible for assisting on the appropriate cyber authorization/approval path IAW the AFLCMC Standard Process for Cybersecurity Assessment and Authorization.
Responsible for creating and delivering program office-level cybersecurity policies, procedures, and associated trainings.
Responsible for reviewing Cybersecurity Impact Evaluation Recommendations (CIERs) for accuracy and completeness.
Responsible for ensuring consistency of work products across the System Program Office (SPO) Cybersecurity Enterprise.
Responsible for providing concurrence/non-concurrence recommendations to the ISSM.
Responsible for providing cybersecurity support to Acquisition Oversight Board (AOB), Acquisition Control Board (ACB), and Configuration Control Board (CCB) documentation.
Responsible for supporting platform, system, and subsystem modifications.
Responsible for maintaining awareness of emergency cybersecurity threats.
Responsible for maintaining certification requirements and providing proof to the Division Chief of Security and the Chief Engineer.
Responsible for supporting a regular meeting cadence with the Security Control Assessor&rsquo;s Representative (SCAR) to maintain situational awareness.
Certification Requirements: Information Assurance Technical (IAT) or Information Assurance Management (IAM) Level II Certification in accordance with AFMAN 17-1303.
Experience Requirements: A minimum of 1 year of relevant Platform Information Technology (PIT) cyber assessment and authorization experience. 
Required Skills/Education: 12 years of experience in the respective technical / professional discipline being performed, five years of which must be in the DoD OR, BA/BS degree, and 15 years of experience in the respective technical/professional discipline being performed, five of which must be in the DoD OR, 20 years of directly related experience with proper certifications as described in the Functionally Aligned Job Descriptions, eight of which must be in the DoD.
Education: Masters Degree
Years&rsquo; Experience: 12
Travel: Yes
Security Clearance Required: TS/SCI
Position Type: Full Time
Work Location: WPAFB OH
Top salaries paid for qualified candidates.
For more information on Sumaria Systems, please visit our website at www.sumariasystems.com
Sumaria is an equal opportunity employer and considers qualified applicants for employment without regard to race, color, creed, religion, national origin, sex, sexual orientation, gender identity and expression, age, disability, or protected veteran status.
Sumaria Systems, LLC (Sumaria) is a market leader in Professional Services, Engineering, and Information Technology has been a trusted partner to U. S. Department of Defense communities for more than 30 years. Sumaria Systems only provides engineering services to the federal government, and does not provide professional engineering or surveying services to the public within the meaning of Ohio Revised Code Section 4733.16. With expertise to lead, insight to deliver and commitment to succeed; we staff each mission with a carefully selected team of seasoned professionals. Headquartered in Danvers, MA, with operating locations in Alabama, Colorado, Georgia, Illinois, Ohio, Oklahoma, Utah, and Virginia.</div>

Cyber Security Management Support

Bank of America

<div>Job Description:
At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. We do this by driving Responsible Growth and delivering for our clients, teammates, communities and shareholders every day. 
 
Being a Great Place to Work is core to how we drive Responsible Growth. This includes our commitment to being an inclusive workplace, attracting and developing exceptional talent, supporting our teammates&rsquo; physical, emotional, and financial wellness, recognizing and rewarding performance, and how we make an impact in the communities we serve. 
 
Bank of America is committed to an in-office culture with specific requirements for office-based attendance and which allows for an appropriate level of flexibility for our teammates and businesses based on role-specific considerations. 
 
At Bank of America, you can build a successful career with opportunities to learn, grow, and make an impact. Join us!<div><div><div>
Job Description
This job is responsible for performing information security reviews of third parties that provide services to the bank. Key responsibilities include travelling to work onsite with third parties to collect and review documentation including playbooks and evidence during an assessment to determine if information security controls are in place and documenting the controls in place in assessment workpapers. Key responsibilities span pre-assessment, assessment, and/or remediation activities.
Job Responsibilities<ul><li>
Partners with third parties to ensure they are prepared for information security assessments including answering detailed questions</li><li>
Evaluates a third parties information security risk with a holistic lens to determine if they meet Bank of America requirements</li><li>
Discusses any information security gaps in the service provider's program with the third party</li><li>
Escalates issues or risks identified during the assessment</li><li>
Manages relationships with third parties and Enterprise Vendor Managers
</li><li>Must be able to travel up to 50% (ie every other week 3-4 days a week)</li><li>
The ability to interact with internal or external stakeholders including business partners and/or external parties to identify, analyze, and resolve complex problems or security gaps.</li><li>
The ability to objectively assess information from various sources and synthesize it towards making a reasoned judgment</li><li>
The ability to assess the security, effectiveness, and practicality of technology systems
</li></ul></div></div></div><div>Required Qualifications:<div><ul><li>
2 + years experience in Information Security and/or IT Audit</li><li>
Technical writing and verbal communication skill</li><li>
Ability to effectively work with partners at varying knowledge and organization levels.</li><li>
Ability to communicate clearly and effectively with both technology/development and business partners &ndash; ability to translate between these two constituencies.</li><li>
Technical skills include the domains of information security and business continuity including:</li><li>
Information Security Controls (Infrastructure Security, Access Management, Physical Security, Application Security, etc.)</li><li>
IT Compliance, SOX Compliance</li><li>
Change Management</li><li>
Enterprise Risk Management</li><li>
Solid grasp of NIST, PCI, ISO, SDLC, COBIT, and ITIL standards</li></ul></div></div><div>
Desired Qualifications<div><ul><li>
Information Security certifications, including ISO27002 / CISSP / CEH / CISM / CISA</li><li>
Knowledge of NIST guidelines</li></ul></div></div>
Shift:
1st shift (United States of America)
Hours Per Week:
40</div>

Cyber Security Onsite Assessor

Turbo Consultin

Role purpose: Leads practical, mission-aligned cybersecurity governance across customer's systems by driving assessment documentation, control implementation guidance, risk evaluations, contingency planning, POA&amp;M management, and cyber compliance reporting.Core responsibilitiesProvide actionable cybersecurity guidance to system and product teams on control implementation, risk mitigation, and compliance with federal and HHS requirements.Develop, upload, maintain, and quality-check assessment artifacts including FIPS 199 categorizations, E-Authentication risk assessments, control implementation statements, and supporting evidence.Evaluate cybersecurity risk for new capabilities, integrations, applications, plug-ins, and system connections before deployment.Lead development, testing, and update cycles for system contingency plans, security SOPs, and governance playbooks.Maintain POA&amp;M tracking, remediation coordination, vulnerability status reporting, and risk dashboards for leadership review.Coordinate closely with engineering, operations, and incident response teams on vulnerability management, incident handling, and cyber data calls.Support audit readiness and maintain evidence packages that withstand IV&amp;V, assessor, and government review.Minimum qualificationsBachelor&rsquo;s degree in cybersecurity, information assurance, computer science, or related field; master&rsquo;s degree preferred.10+ years of cybersecurity risk, compliance, or RMF experience, including at least 5 years supporting federal systems.Deep working knowledge of NIST RMF, FISMA, HHS/NIH controls, SSPs, POA&amp;Ms, contingency planning, and security documentation.Proven ability to coordinate across technical and non-technical stakeholders in a fast-paced mission environment.CISSP and CAP strongly preferred; CISM, FedRAMP Practitioner, or Zero Trust training desirable.Experience with cloud security, SaaS governance, vulnerability scanning, and continuous monitoring.Familiarity with risk repositories, evidence management, dashboards, and governance reporting.Preferred qualifications / certificationsExperience supporting healthcare, research, or biomedical environments handling sensitive data.Pay: $150,000.00 - $200,000.00 per yearBenefits:<ul><li>401(k)</li><li>401(k) matching</li><li>Dental insurance</li><li>Health insurance</li><li>Life insurance</li><li>Paid time off</li><li>Retirement plan</li><li>Vision insurance</li></ul>Work Location: Hybrid remote in Washington, DC 20036

Cybersecurity Risk Manager

SoftThink Solutions Inc

<div><div><div>Benefits:</div>
<ul><li>401(k)</li>
<li>401(k) matching</li>
<li>Competitive salary</li>
<li>Training &amp; development</li>
</ul></div><div><div>Role: ISSO 
Location: Washington, DC 20005. 
Security Clearance 
<ul><li>BS/BA in Computer Science, Information Systems, Software Engineering, or other related analytical, scientific, or technical discipline.</li><li>Certified Information Systems Security Professional (CISSP) Certification, GIAC Enterprise</li><li>Vulnerability Assessor, or Certified Information Systems Auditor (CISA) is highly preferred. Experience working as an ISSO in the Federal Government environment.</li><li>Knowledge of Federal Government SA&amp;A practices and policies, particularly FISMA and NIST</li><li>Special Publications 800 series.</li><li>Industry-recognized and accepted certifications relating to Project Management preferred (Project</li><li>Management Professional (PMP) preferred for project or program managers.</li><li>Ability to work independently and collaborate with application developers, engineers, and others.</li><li>Must be motivated and results oriented.</li><li>Effective written and oral communication skills.</li></ul></div></div></div>

Information system security officer

Search 10000+ Security control assessor jobs near you this March. New roles added regularly across leading industries. Apply today.