Bachelor's Degree or four years of equivalent professional experience.
5-7 years of relevant experience in security control assessments or cybersecurity evaluations.
Experience leading assessments with Security Assessment Teams and related roles.
Strong understanding of NIST SP 800-53 security controls and cybersecurity frameworks.
Demonstrated oversight experience with federal cybersecurity frameworks like NIST RMF.
Ability to analyze technical documentation and communicate findings effectively.
Strong grasp of continuous monitoring processes and system inheritance concepts.
Responsibilities
Oversee comprehensive assessments of security and privacy controls for effectiveness.
Lead evaluation and documentation of deficiencies and recommend corrective actions.
Prepare detailed security and privacy assessment reports for Team Leaders.
Conduct assessments in line with approved assessment plans.
Perform initial remediation actions on deficient controls and validate effectiveness through reassessments.
Assess system-specific and inherited controls as part of continuous monitoring.
Contribute to deliverables and performance metrics across complex assignments.
Benefits
Comprehensive benefits program including medical, dental, and vision insurance.
Life insurance and 401(k) plan available.
Range of voluntary benefits offered.
Paid Time Off (PTO) for full-time and part-time employees.
Full Job Description
The A&A Specialist III (Mid-Level) supports this mission by overseeing and conducting comprehensive assessments of security and privacy controls, identifying risks, and recommending corrective actions to ensure DOE systems meet all required cybersecurity and privacy standards. This position also oversees and responds to system- and security-related data calls, research, and analysis as requested from DOE.
Responsibilities
Oversee and lead comprehensive assessments of implemented security and privacy controls and control enhancements to determine effectiveness, including whether controls are implemented correctly, operating as intended, and producing desired outcomes.
Lead the evaluation and documentation of the severity of deficiencies identified during assessments and provide proper oversight and guidance in recommending appropriate corrective actions to mitigate vulnerabilities.
Lead preparation of detailed security and privacy assessment reports outlining results, findings, and recommendations, and deliver these to Team Leaders for review and decision-making.
Oversee the assessment of controls in accordance with assessment procedures defined in approved assessment plans.
Oversee and conduct initial remediation actions on deficient controls and perform reassessments on remediated controls to validate effectiveness.
Assess both system-specific and inherited controls as part of the Department's continuous monitoring strategy.
Apply comprehensive knowledge to multiple complex assignments and contribute to deliverables and performance metrics as required.
Assessment and Authorization Duties:
Oversee assessments of existing and new NIST and FISMA systems, including subsystems within respective system boundaries, communicate results, articulate potential implications of identified control weaknesses, and work to document through artifacts and documentation.
Lead and oversee assessments within Cloud environments such as SaaS, PaaS, and IaaS, and systems and platforms within an on-prem environment.
Lead and oversee the review, analysis, and creation of Assessment & Authorization (A&A) packages to include Assessment Readiness Workbooks (ARW), Security Assessment Plans (SAP), Security Assessment Reports (SARs), and Risk Assessments for completeness, accuracy, and effectiveness of controls.
Lead and oversee the review, analysis, and creation of findings packages outlining identified findings, weaknesses, remediation, and provide an overview during findings meeting reviews.
Oversee the review of significant system change requests, deviation requests, and provide oversight and leadership on potential system or system security impacts.
Review and analyze vulnerability scan reports, test reports, and Plan of Action & Milestones (POA&Ms), Hardware/Software lists, Network Diagrams, Data Flows, System Change Requests/Proposal, for completeness, accuracy, effectiveness of controls, and plans and procedures implementation.
Review identified and documented findings and provide oversight, leadership, and recommendations to support documentation, rationalization, and subsequent remediation efforts.
Oversee and lead security-and system-related data calls for internal and external audits such as FISMA and data calls as requested.
Qualifications
Bachelor's Degree or four (4) years of equivalent professional experience.
Minimum of 5-7 years of relevant experience conducting security control assessments, cybersecurity evaluations, or similar technical security work.
Experience overseeing and participating in assessments and working with Security Assessment Teams (SAT), Security Control Assessors (SCA), Information System Security Officers (ISSO), Technical Points of Contact (TPOC), System Owners, and Assessment Coordinators.
Possesses a strong understanding of the NIST Special Publication 800-53 security and privacy controls, the NIST Cybersecurity Framework, and other information security and privacy laws and regulations.
Demonstrated oversight experience assessing security and privacy controls aligned with federal cybersecurity frameworks (e.g., NIST RMF, NIST SP 800-53).
Ability to analyze technical documentation, identify security gaps, and communicate findings clearly in written reports.
Strong understanding of continuous monitoring processes and system inheritance concepts.
Ability to work independently and collaboratively on complex assignments requiring sound judgment and comprehensive technical knowledge.
Ability to complete a DOE background investigation and obtain federal government clearance for access to federal systems.
Ability to obtain DOE Q clearance.
Any clearance requirements for this position are established by the government contract.
Job ID
2026-27285 Work Type
Remote Pay Range
$150,000 - $160,000 Benefits
Regular - The company offers a comprehensive benefits program, including medical, dental, vision, life insurance, 401(k) and a range of other voluntary benefits. Paid Time Off (PTO) is offered to regular full-time and part-time employees.
