Position SummaryThe Senior Security Control Assessor leads FedRAMP assessments within Insight Assurance's A2LA-accredited FedRAMP 3PAO practice. This role is accountable for the quality of the deliverables on assigned engagements, signs off on the assessment work the team performs, and mentors Junior and Mid-Level Assessors. You will evaluate security controls in cloud systems against FedRAMP and NIST requirements across Rev5 and FedRAMP 20x, and will also work on GovRAMP and other federal assessments.
This is an independent assessment role. It does not include consulting, remediation design or sales support. The team does not perform CMMC work.
Requirements- Active Certified Information Systems Security Professional (CISSP).
- At least one additional active certification from the A2LA-approved list below: CASP+ CE; GCED; GCIH; GSLC; CISA; CISM; CCSP; CISSP-ISSAP; CISSP-ISSEP; CISSP-ISSMP; CFR; CCISO. If you hold only the CISSP, completing the BCR Cyber activity after hire also satisfies this requirement.
Preferred- Other relevant security certifications, for example CGRC, ISO 27001 Lead Auditor, or an AWS, Azure or Google cloud security or architect certification. Insight Assurance reviews other certifications for relevance.
EXPERIENCE- Minimum five years of auditing and/or assessment experience in security compliance frameworks.
- Experience leading assessment engagements or mentoring assessors.
- Prior experience with FedRAMP, FISMA or NIST SP 800-53 assessments is strongly preferred.
- Prior 3PAO, GovRAMP, TX-RAMP or FedRAMP 20x experience is preferred.
DUTIES AND RESPONSIBILITIESEngagement Delivery- Lead assessments from planning through reporting: the SAP, SAR and RET for Rev5, KSI-based reporting for FedRAMP 20x, and GovRAMP RAR, SR-SAP and SR-SAR.
- For FedRAMP 20x, test both the security capability and the measurement system behind each Key Security Indicator, including code review, API testing and cloud architecture analysis. Check that automated evidence runs at the stated cadence, covers the full scope and is reproducible.
- Review and validate findings against the FedRAMP Criteria for Document Acceptance, and include the required authorization recommendation in each SAR.
- Sign off on the assessments assigned to you. Escalate any doubt about quality, evidence or independence to the Technical Manager.
- Serve as the primary contact for assessment communications with the client. Record disagreements and keep your assessment record separate from the provider's.
Team Leadership- Lead the assessment team with the Project Manager and keep staffing within A2LA minimums (Senior Assessor, Penetration Tester and Junior Assessor).
- Mentor, supervise and evaluate Junior and Mid-Level Assessors, and help deliver internal training.
Quality and Independence- File the After Action Report within 30 days of engagement end, support A2LA witnessing, surveillance and for-cause assessments, and report any conflict of interest right away.
- Do not design, select or implement a client's remediation, and do not provide advisory services or sales support to any client you assess. Findings carry the FedRAMP-required recommendation only.
- Do not assess a client that Insight Assurance advises or has advised, and disclose any prior relationship with a CSP you may be assigned to.
SKILLSTechnical Skills- Deep knowledge of NIST SP 800-53 Rev5 and 800-53A, FedRAMP baselines and cloud security.
- Working knowledge of cloud-native architecture (AWS, Azure, GCP), Infrastructure-as-Code such as Terraform, CI/CD pipelines and API-based evidence collection.
- Ability to read scripts, queries and IaC well enough to test automated validation.
Professional Skills- Strong leadership, written and verbal communication, and analytical skills.
- Ability to assess complex cloud systems and to hold an independent position under client pressure.
EDUCATIONRequiredBachelor's degree in Information Technology, Cybersecurity or a closely related field, or equivalent experience.
PreferredMaster's degree in Information Technology, Cybersecurity or a related discipline.
Benefits- Flexible Paid Time Off and paid Holidays
- 100% Remote
- Competitive salary and benefits package.
- Opportunities for professional growth and development.
- Collaborative and innovative work environment.
- Paid BCR Cyber exam and paid annual training.
- A defined career path to Senior Manager, Federal Assessments.
