Security Control Assessor

Position: Security Control Assessor Duration: 6 months with extension Possible Location: Sacramento, CA (Hybrid) Can attend the Sacramento office for two consecutive days each month, generally the first Wednesday and Thursday. Position Overview The Independent Security & Privacy Assessor will conduct independent, risk-based security and privacy assessments of complex cloud-based systems that process confidential or regulated data. This position must operate independently from personnel responsible for designing, implementing, administering, or operating the controls being assessed. Key Responsibilities Security & Privacy AssessmentsConduct independent security and privacy assessments.Assess complex cloud-based systems handling confidential or regulated data.Perform assessments using:CMS ARC-AMPENIST SP 800-53 Revision 5Plan and execute assessment activities.Evaluate security-control effectiveness.Identify control weaknesses, vulnerabilities, and gaps.Develop risk-based remediation recommendations.CMS Compliance DocumentationPrepare required CMS assessment documentation.Prepare and maintain the Security Assessment Workbook.Support annual compliance and authorization activities.Maintain assessment workpapers and supporting evidence.Participate in quality reviews and assessment reporting.Independence RequirementsMaintain reporting lines separate from operational security-support personnel.Remain independent from individuals who designed, implemented, administered, or operated the controls being assessed.Support separate engagement leadership and escalation paths.Maintain objective assessment workpapers and findings.Provide independent recommendations for corrective action and remediation. Required Qualifications Experience conducting independent security/privacy assessments.Strong knowledge of CMS ARC-AMPE and/or NIST SP 800-53 Revision 5.Experience assessing cloud-based systems.Experience evaluating security controls and identifying vulnerabilities.Experience developing risk-based remediation recommendations.Experience preparing formal assessment documentation.Direct experience with Security Assessment Workbooks is highly desirable.Experience in regulated public-sector, healthcare, or health-exchange environments is preferred.Relevant security certifications are desirable.