Assessment Lead
Avint · Washington · $150,000–$165,000 (stated in the posting)
Avint is seeking a highly motivated Assessment Lead in support of a critical government contract. The Assessment Lead is a Security Controls Assessor (SCA) responsible for overseeing a team of cybersecurity professionals dedicated to assessing, testing, and validating the effectiveness of information security controls across organizational systems. This role combines technical expertise in security assessment frameworks with leadership responsibilities, ensuring that all IT systems, applications, and infrastructures comply with relevant regulatory requirements, organizational policies, and industry best practices. The Assessment Lead guides the execution of Security Assessment and Authorization (A&A) processes, manages workload distribution, and acts as a primary liaison between the assessment team and system stakeholders. Additionally, as a seasoned professional, the Assessment Lead will serve as an Avint career manager and guide the professional advancement of junior team members.
Requirements
Leadership, Oversight & Team Management
- Serve as the primary contractor lead and subject matter expert for Security Control Assessment activities.
- Provide technical direction and oversight to Security Control Assessors and other contractor personnel supporting assessment activities.
- Ensure assessors appropriately apply examination, interview, and testing procedures and that assessment conclusions are supported by sufficient and appropriate objective evidence.
- Maintain assessment independence and ensure assessment personnel do not assess controls for which they were directly responsible for implementing, except where specifically authorized by the Government.
- Oversee and facilitate the professional and educational development of junior Avint teammates.
Planning, Coordination & Stakeholder Engagement
- Plan, coordinate, and oversee the execution of Security Control Assessments across assigned information systems and environments.
- Develop and maintain assessment schedules, milestones, resource assignments, and assessment priorities in coordination with the Government.
- Lead assessment entrance meetings, status meetings, technical discussions, findings reviews, and assessment exit briefings with Government and system stakeholders.
- Coordinate assessment activities with System Owners, Information System Security Officers (ISSOs), Information System Security Managers (ISSMs), system administrators, security engineers, technical teams, and other Government-designated stakeholders.
- Provide assessment status, metrics, risks, accomplishments and issues to the COR and other Government-designated personnel as required.
Assessment Methodology, Execution & Control Testing
- Lead the development, review, and execution of Security Assessment Plans (SAPs), including assessment scope, control selection, assessment procedures, evidence requirements, testing methodology, and Rules of Engagement (ROE), as applicable.
- Review system security documentation, policies, procedures, technical configurations, architecture documentation, vulnerability scan results, penetration testing results, prior assessment findings, Plans of Action and Milestones (POA&Ms), and other supporting evidence necessary to determine control effectiveness.
- Evaluate the implementation and effectiveness of security and privacy controls and identify control deficiencies, vulnerabilities, weaknesses, and associated cybersecurity risks.
- Ensure assessment findings clearly document the condition identified, supporting evidence, applicable control or requirement, risk, and assessment determination.
- Support validation and retesting activities to determine whether identified deficiencies have been successfully remediated.
Deliverables, Quality Assurance & Documentation
- Perform quality assurance reviews of assessment work products to ensure findings are technically accurate, consistent, adequately supported, and compliant with Government assessment standards.
- Review and approve contractor-developed assessment documentation prior to submission to the Government.
- Lead the preparation and delivery of Security Assessment Reports (SARs), assessment findings, risk summaries, executive-level briefings, and other required assessment deliverables.
- Track assessment findings and deliverables through closure and ensure assessment records and supporting evidence are maintained in Government-designated repositories and cybersecurity tools.
Risk Management, Governance & Compliance
- Ensure assessment activities are performed in accordance with applicable versions of NIST Special Publication (SP) 800-37, NIST SP 800-53, NIST SP 800-53A, FISMA requirements, Department policies, and Government-established cybersecurity assessment procedures.
- Monitor assessment progress and proactively identify schedule risks, evidence deficiencies, technical issues, or other conditions that may affect successful completion of an assessment.
- Support the Government in evaluating residual risk and provide technical assessment information necessary to support authorization and risk-based decisions by the Authorizing Official (AO) and other designated Government officials.
- Identify recurring control deficiencies, systemic weaknesses, and assessment trends and provide recommendations to the Government for improving security posture, assessment consistency, and RMF execution.
- Ensure assessment activities and sensitive security information are handled in accordance with applicable Federal and Department security, privacy, records management, and information-handling requirements.
Qualifications
Clearance Requirements:
- Must be a U.S. citizen without dual citizenship (no green card or visa)
- Secret clearance; TS/SCI preferred
Education Requirements:
- Bachelor's degree in computer science, information technology, cybersecurity, or related field
- CISSP, CISA, or equivalent/higher level certification
- CEH or equivalent/higher penetration testing certification
Experience: at least eight (8) years of experience conducting security control assessments
Soft Skills:
- Strong analytical, critical thinking, and problem-solving skills with a high level of technical professional skepticism
- Excellent technical writing skills, with the ability to clearly document complex technical findings and defend assessment results to stakeholders
- Exceptional interpersonal and diplomatic skills, allowing for productive collaboration with system administrators, developers, and management
Benefits
Joining Avint is a win-win proposition! You will feel the personal touch of a small business and receive BIG business benefits, from competitive salaries, full health insurance, generous time off, and observation of federal holidays. Additionally, we encourage every Avint employee to further their professional development. To assist you in achieving your goals, we offer reimbursement for courses, exams, and tuition. Interested in a class, conference, program, or degree? Avint will invest in YOU and your professional development!
Annual Salary Range: $150,000-$165,000