Security Control Assessor

Join to apply for the Security Control Assessor role at ECS

Location:

Washington, DC

ECS is seeking a Security Control Assessor to work in our Washington, DC office. This role is part of the Independent Security Control Assessment (ISCA) team, ensuring high-value and mission‑critical systems comply with federal cybersecurity policies.

The role supports the Department of State (DOS) and the Bureau of Diplomatic Technology (DT). The candidate will execute the full Risk Management Framework (RMF) Step 4 lifecycle, developing Security Assessment Plans (SAP), conducting detailed control testing under NIST SP 800‑53A Rev. 5, and producing Security Assessment Reports (SAR) for Authorizing Officials.

• Assessment Planning (RMF Step
  4): develop and finalize Security Assessment Plans, collaborate with stakeholders to define testing strategies.
• Security Control Assessment: perform independent and comprehensive assessments using manual and automated techniques.
• Reporting & Risk Analysis: develop SARs detailing findings, prepare risk acceptance recommendation reports and executive briefings.
• Remediation & Continuous Monitoring: coordinate mitigation strategies, conduct retesting, support continuous monitoring by assessing a subset of controls annually.

• Active Secret Security Clearance.
• 5+ years of Information Security experience, with at least 3 years specifically supporting security assessment teams.
• Deep understanding of NIST SP 800‑53 Rev. 5, NIST SP 800‑53A, and NIST SP 800‑37 Rev. 2.
• Proven experience developing RMF artifacts including SAPs, SARs, and POA&Ms.
• Experience with eGRC tools (e.g., Arch Angel, CSAM, Xacta, Archer) and analyzing vulnerability scan reports.
• Strong communication skills, able to present control deficiencies and risk implications to both technical and non‑technical audiences.

• Certifications:
  
  CISSP, CISA, CEH, or CRISC (highly preferred).
• Agency
  
  Experience:
  
  prior experience with the Department of State and High‑Value Asset (HVA) assessments.
• Cloud Security: experience assessing systems hosted in AWS or Azure cloud environments.

General description of benefits.

Salary Range: $90,000 - $120,000.

ECS is an equal opportunity employer and does not discriminate on the basis of any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran, or any other status protected by applicable federal, state, or local jurisdiction law.