Security Control Assessor

Position Overview

The Independent Security & Privacy Assessor will conduct independent, risk-based security and privacy assessments of complex cloud-based systems that process confidential or regulated data. This position must operate independently from personnel responsible for designing, implementing, administering, or operating the controls being assessed.

Key Responsibilities

Security & Privacy Assessments

• Conduct independent security and privacy assessments.
• Assess complex cloud-based systems handling confidential or regulated data.
• Perform assessments using:
  • CMS ARC-AMP
  • NIST SP 800-53 Revision 5
• Plan and execute assessment activities.
• Evaluate security-control effectiveness.
• Identify control weaknesses, vulnerabilities, and gaps.
• Develop risk-based remediation recommendations.

CMS Compliance Documentation

• Prepare required CMS assessment documentation.
• Prepare and maintain the Security Assessment Workbook.
• Support annual compliance and authorization activities.
• Maintain assessment workpapers and supporting evidence.
• Participate in quality reviews and assessment reporting.

Independence Requirements

• Maintain reporting lines separate from operational security-support personnel.
• Remain independent from individuals who designed, implemented, administered, or operated the controls being assessed.
• Support separate engagement leadership and escalation paths.
• Maintain objective assessment workpapers and findings.
• Provide independent recommendations for corrective action and remediation.

Required Qualifications

• Experience conducting independent security/privacy assessments.
• Strong knowledge of CMS ARC-AMP and/or NIST SP 800-53 Revision 5.
• Experience assessing cloud-based systems.
• Experience evaluating security controls and identifying vulnerabilities.
• Experience developing risk-based remediation recommendations.
• Experience preparing formal assessment documentation.
• Direct experience with Security Assessment Workbooks is highly desirable.
• Experience in regulated public-sector, healthcare, or health-exchange environments is preferred.
• Relevant security certifications are desirable.