Security Control Assessor

Overview

Steampunk is seeking a Security Control Assessor to support a government customer, ensuring risk within the system is maintained at an acceptable level. This role requires initiative, organization, strong communication across all levels of the organization, and sound judgment with sensitive and confidential information in a fast-paced environment.

Responsibilities

As a member of one of our assessment teams, you will play an important role in performing a wide array of cybersecurity duties including:

• Lead security assessments in accordance with NIST SP 800-53, NIST RMF (SP 800-37), FedRAMP, and agency-specific guidance.
• Evaluate technical, operational, and management controls across cloud, on-premises, and hybrid environments, including hands-on review of technical control evidence (e.g., encryption configurations, SIEM logging, identity/access management, network boundary controls, STIG compliance).
• Develop Assessment Plans and Security Assessment Reports (SARs), and document findings and risk in compliance with FISMA, FedRAMP, and organizational standards.
• Coordinate with ISSOs, System Owners, and Authorization Officials to review evidence and remediate control deficiencies.
• Analyze vulnerability scans, configuration baselines, and penetration test results to determine control effectiveness and recommend remediation.
• Present findings and risk analysis to management and Authorization Officials.
• Support continuous monitoring and control validation for ongoing authorization.

Qualifications

• Bachelor's Degree and 5 years of relevant experience; OR
• No degree with a total of 9 years of relevant experience; OR
• Master's degree and 3 years of relevant experience
• One of the following certifications (may be obtained within six (6) months of hire):
• Certified Information System Security Professional (CISSP)
• CompTIA Advanced Security Practitioner (CASP)
• Certified Information Systems Auditor (CISA)
• Certified Information Security Manager (CISM)
• Strong knowledge of NIST SP 800-53, FIPS 199/200, and NIST SP 800-30/37/39/53/60; familiarity with DHS Directive 4300A.
• Hands-on experience reviewing security control artifacts and providing independent evaluations for system authorization packages, including in cloud environments (AWS, Azure).
• Proficiency with assessment/scanning tools (e.g., Nessus, Tenable.SC, Splunk, SCAP scanners) and analytical skill to interpret vulnerabilities and compliance gaps.
• Demonstrated ability to review technical controls directly, as a core part of the role — for example: verifying FIPS-validated encryption, auditing SIEM logging architecture, reviewing IAM/MFA enforcement (AD, Okta, Azure AD), analyzing firewall/ACL/Security Group configurations, and evaluating DISA STIG results.

Preferred

• Experience as a Security Control Assessor and performing risk analysis/assessment.
• Working knowledge of AWS/Azure GovCloud and enterprise application stacks (e.g., Maven, Jenkins, Ansible, Tomcat, IIS, F5, Oracle, MSSQL, PostgreSQL).
• Familiarity with AI/ML concepts and their security implications.
• Working knowledge of JIRA, ServiceNow, or equivalent.