Senior Security Control Assessor

Tharros supports the Department of Homeland Security (DHS) with cybersecurity services across its Intelligence Enterprise.

In support of this mission, we have an immediate opportunity for a Senior Security Control Assessor. In this role you will lead the most complex assessments in the portfolio, including Cross Domain Solutions (CDS), Special Access Program (SAP) systems, C-LAN extension sites, and cloud environments. You will guide junior assessors, improve A&A standard operating procedures, and help modernize the authorization process toward ongoing authorization and reciprocity. This position is on-site in a Government SCIF in Washington, DC.

Duties include but not limited to:

• BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 10 years' experience in IT or cybersecurity.
• Minimum of 7 years' experience in RMF security control assessment.
• Active TS/SCI clearance and U.S. citizenship; willingness to undergo a DHS counterintelligence-scope polygraph.
• Knowledge of ICD 503, CNSSI 1253, and the Risk Management Framework (RMF).
• Knowledge of Cross Domain Solution or SAP system assessment requirements.
• Knowledge of cloud security authorization concepts.
• Skill in using at least two security tools (e.g., Nessus/ACAS, SCAP, WebInspect, SonarQube, STIG Viewer).
• Skill in developing and improving assessment procedures and SOPs.
• Ability to lead complex assessments and mentor junior staff.
• Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.
• Excellent written and oral communications skills.

• Must have an active Top Secret clearance.
• Requires 7-10 years related experience.
• Must be able to assess the security controls employed within and inherited by an information system using assessment procedures specified in the security assessment plan.
• Must be able to provide specific recommendations on how to correct weaknesses or deficiencies in the controls and address identified vulnerabilities.
• Excellent written and verbal communication skills.
• Proficient in Microsoft Office Suite to include Teams or similar workplace chat and videoconferencing tools.