VMD Corp

Security Control Assessor

VMD Corp • $95K — $115K *
Arlington, VA 22204Hybrid
Technical Services
Less than 5 years of experience
Today
Be an Early Applicant
Job Overview by Ladders

Qualifications

  • 4-6 years of relevant cybersecurity experience, specifically in security control assessments for federal clients.
  • Bachelor's degree in a cyber-related field, with direct experience or certifications as a substitute.
  • Recognized cybersecurity certifications preferred (CISSP, CISM, CISA, CAP, GIAC, or CompTIA certifications).
  • Demonstrated knowledge of federal cybersecurity governance frameworks (RMF, FedRAMP, NIST SP 800-53 and SP 800-171).
  • Strong understanding of cybersecurity principles including confidentiality, integrity, and risk management.

Responsibilities

  • Identify security and privacy requirements for systems.
  • Collaborate with System Owners to document security categorization results.
  • Identify stakeholders with security and privacy interests related to systems.
  • Conduct initial risk assessments and update them continuously.
  • Select and document security and privacy controls for the system.
  • Develop a strategy for monitoring control effectiveness and coordinate it at various levels.
  • Document changes to security and privacy control implementations and maintain configuration baselines.

Benefits

  • Hybrid work environment, allowing flexibility in work location.
  • Opportunity to work closely with federal clients and within regulatory frameworks.
  • Collaborative team environment focused on security and privacy compliance.
Full Job Description
Description

Position at VMD Corp

The Security Control Assessor ensures that the security and privacy posture is maintained for an organizational system and works in close collaboration with the FDIC system owners. The Security Control Assessor serves as an advisor on all matters, technical and otherwise, involving the security and privacy controls for the system and has the knowledge and expertise to manage the security and privacy aspects of an organizational system.

Responsibilities:

  • Identify the security and privacy requirements allocated to a system and to the organization, identify the characteristics of a system, contribute to determining the boundary of a system.
  • Collaborate with the System Owner to categorize the system and document the security categorization results as part of system requirements.
  • Identify stakeholders who have a security and/or privacy interest in the development, implementation, operation, or sustainment of a system.
  • Conduct an initial risk assessment of stakeholder assets and update the risk assessment on an ongoing basis.
  • Select the security and privacy controls for a system and document the functional description of the planned control implementations in a security/privacy plan.
  • Develop a strategy for monitoring security and privacy control effectiveness; coordinate the system-level strategy with the organization and mission/business process-level monitoring strategy.
  • Develop, review, and approve a plan to assess the security and privacy controls in a system and the organization.
  • Document changes to planned security and privacy control implementation and establish the configuration baseline for a system.
  • Respond to system risk posture based on the results of ongoing monitoring activities, assessment of risk, and outstanding items in a plan of action and milestones (POA&M).
  • Update a security plan, security assessment report, and plan of action and milestones based on the results of a continuous monitoring process.
  • Review the security and privacy status of a system (including the effectiveness of security and privacy controls) on an ongoing basis to determine whether the risk remains acceptable.
  • Report the security status of a system (including the effectiveness of security and privacy controls) to an authorizing official on an ongoing basis in accordance with the monitoring strategy.
  • Ensure that plans of actions and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, ensure that security improvement actions are evaluated, validated, and implemented as required.


Experience needed to be successful:

  • Demonstrated knowledge in the use of cyber legal, regulatory, and policy, specifically knowledge of federal cybersecurity governance frameworks, i.e., RMF, FedRAMP, and NIST Special Publications such as SP 800-53 and SP 800-171. Development and review of key authorization artifacts such as SSPs, SARs, POA&Ms
  • Demonstrated knowledge of cybersecurity principles, threats, and vulnerabilities, specifically strong knowledge of cybersecurity principles, i.e., confidentiality, integrity, availability, authentication, and risk management.
  • Demonstrated experience in the application of frameworks such as RMF, NIST SP 800-53, and FedRAMP to ensure enterprise-wide security compliance
  • Demonstrated experience of technical systems and tools in a wide range of cyber security defense tools and systems
  • Demonstrated experience of access, architecture, and infrastructure through applied knowledge of authentication, authorization, and access control methods
  • Demonstrated experience in business, operations, and risk management in particular risk management processes using frameworks such as RMF, NIST SP 800-53, and FedRAMP to assess and mitigate vulnerabilities across federal and commercial environments. Development of security documentation, including SSPs, SARs, and POA&Ms


Requirements:
  • Experience: 4-6 years of Relevant Cybersecurity Experience - specifically performing security control assessments in a SCA role, including supporting federal clients
  • Education: Bachelors Degree in Cyber-related field (Direct experience or certifications may substitute for the academic credentials)
  • Desired Certifications: Recognized cybersecurity certifications (e.g., CISSP, CISM, CISA, CAP, GIAC, or CompTIA certifications such as Security+ or CASP+)
  • Citizenship: U.S. Citizen
  • Clearance: Public Trust


Location: Arlington, VA (Hybrid). Must reside within the DC Metro area.

About VMD Corp

VMD Corp is a healthcare company that provides a range of services, including medical staffing, consulting, and technology solutions. The company's clients include hospitals, clinics, and government agencies. VMD Corp was founded in 2002 and is headquartered in Emeryville, California.
Learn more about VMD Corp
Size
1,000 employees
Industry
Healthcare
Net Income
$5 million
Founded
2002
5 Year Trend
+10%
Revenue
$100 million
* Ladders Estimates

Similar Jobs

Ad banner background

Get Ready For Your
Next Interview

More Jobs at VMD Corp

More Technical Services Jobs

Find similar Security Control Assessor jobs:

NationwideArlington, VA