Security Control Assessor

About the Role

The Security Control Assessor will evaluate information systems and security controls to identify risks, vulnerabilities, and compliance gaps. This role involves conducting security assessments, reviewing policies and procedures, and providing strategic recommendations to enhance security posture and ensure compliance with SAFR requirements and established security standards. The assessor will also advise stakeholders on security best practices, risk mitigation strategies, and security improvements.

Key Responsibilities

• Conduct comprehensive assessments of information security controls, policies, and procedures to identify risks, vulnerabilities, and compliance gaps.
• Review assessment data and advise stakeholders on SAFR requirements, security best practices, and remediation strategies.
• Evaluate and prioritize security risks, recommending enhancements to strengthen the organization's security posture.
• Support the development and integration of new security processes with existing frameworks.
• Communicate policy, process, and security updates effectively to impacted stakeholders and clients.
• Build collaborative relationships with stakeholders, influencing security outcomes through consultative engagement.
• Apply risk management principles when evaluating security controls and making strategic recommendations.
• Participate in projects involving security process development, implementation, and integration.
• Perform other related duties as assigned.

Required Qualifications

• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or a related field, or equivalent experience.
• 3–5+ years of relevant experience in security assessment, cybersecurity, or compliance.
• Proven experience conducting security assessments and evaluating security controls.
• Knowledge of security frameworks and continuous authorization processes, including NIST SP 800-37 and NIST SP 800-53/53A.
• Experience reviewing security data and advising on compliance requirements and best practices.
• Strong understanding of risk management principles and their application to security decisions.
• Excellent written and verbal communication skills, with the ability to collaborate across technical and business teams.
• Strong analytical, problem-solving, and negotiation skills.
• Attention to detail and the ability to evaluate complex information to develop practical recommendations.
• Ability to build effective relationships and communicate security requirements clearly to diverse stakeholders.

Preferred Qualifications

• Professional certifications such as CISSP, CISA, or CISM.
• Experience working in policy, security assurance, regulatory, or quasi-governmental environments.
• Familiarity with cloud security challenges and cloud service providers.
• Knowledge of SAFR lifecycle compliance, assessment, and testing.
• Experience supporting security policies, controls, and processes across complex organizations.
• Familiarity with continuous monitoring, authorization, and risk management processes.