Job Description Job Description About Us: FIDx is a groundbreaking, industry-changing, growing company out of Berwyn, Pennsylvania. We provide a platform that allows financial advisors to fully integrate annuities into the advisory ecosystem and modernizes annuity distribution. We do this by providing a top technology and services platform that connects the legacy tools, experience and expertise of high-quality insurance companies to the advisory marketplace. About the Opportunity: The Head of Information Security plays a critical role in protecting FIDx's platform, data, and reputation as the company scales its mission of modernizing annuity distribution. As a senior security leader in the firm, the Head of Information Security is responsible for defining and executing the company's information security, data privacy, and cyber-risk strategy - safeguarding the sensitive financial and personal data that flows across our platform and our deep integrations with carriers, advisors, and partners. This position brings executive security experience, an execution mindset, and a bias toward action to embed security into every layer of the business. The role reports to the Chief Technology Officer, with regular, direct engagement with the CEO, executive team, and Board on matters of risk and security posture. The position encompasses a wide range of activities with involvement in all phases of security governance, risk and compliance, security architecture, security operations, and incident response. It requires exemplary energy and work ethic, excellent people skills, and business acumen. The Head of Information Security is responsible for planning, organizing, directing and controlling the day-to-day security operations of the firm, and for directing the implementation of the firm's security policies - balancing rigorous protection with the speed and agility of a growing fintech. As an early-stage, small company, FIDx expects this to be a hands-on, roll-up-your-sleeves role. Out of the gate the Head of Information Security will personally own and operate the security function - effectively a team of one - doing the work directly rather than managing others who do it. As the company scales, this leader will have both the opportunity and the responsibility to build, hire, and lead a dedicated security team. This is an engaging position for a dynamic self-starter that requires significant attention to detail, entrepreneurial thinking and efficient and effective decision making. This person is entrepreneurial, self-directed and passionate about protecting the experiences we deliver to customers, advisors, investors, clients, and employees. Essential Functions Own and operate the firm's information security program, and serve as the firm's primary subject matter expert on cybersecurity, data privacy, and information-security compliance. Establish, own, and continuously mature the enterprise information security program, including policies, standards, and controls, for approval by the CTO and executive team. Support strategic planning for the future and assessing the security implications of new product lines, markets, and partnerships, and recommending how to pursue them securely. Build a strong understanding of both the technology and business aspects of the product, as security must enable delivery of the platform rather than impede it. Run the company's day-to-day security operations, creating security strategies and policies, communicating them across the organization, and building company-wide alignment with a security-first culture. Security Strategy, Architecture & Execution (35%): Build and execute the information security roadmap in alignment with the strategy and priorities set with the CTO and executive team. Work directly with development and DevOps staff to embed security into the SDLC - secure-by-design principles, secure coding standards, code review, and dependency/supply-chain management. Provide hands-on technical guidance to scrum teams as necessary to ensure security requirements are met without compromising delivery deadlines. Define and maintain security architecture across cloud infrastructure, APIs, and the application layer; establish standards for identity and access management (IAM), encryption, key management, and data protection. Set comprehensive goals for security performance and maturity; select, implement, and manage the security toolchain (e.g., SIEM, vulnerability management, endpoint protection, cloud security posture management). Run threat modeling, penetration testing, and vulnerability management programs, and drive timely remediation. Partner with Product and Engineering to ensure new products, features, and integrations are delivered securely. Lead day-to-day Security functions in partnership with the CTO and DevOps, ensuring our technology and processes are secure and meet audit requirements. Risk Management, Compliance & Audit (40%): Run the enterprise cyber-risk management program: identify, assess, prioritize, and mitigate information-security and data-privacy risks, and maintain a clear risk register. Ensure compliance with applicable regulatory and industry frameworks relevant to insurance and financial services (e.g., SOC 2, NIST CSF / 800-53, ISO 27001, GLBA, and state privacy laws such as CCPA). Manage and coordinate internal and external audits, regulatory examinations, and client and partner security assessments; maintain evidence and drive remediation of findings. Run third-party and vendor risk management, including due diligence and ongoing monitoring of partners, carriers, cloud providers, and platform integrations. Support and maintain data privacy and data governance programs. Develop, maintain, and regularly test business continuity and disaster recovery plans. Provide timely, accurate and complete reporting, dashboards, and metrics on the firm's security and risk posture; write and submit reports to the CTO and executive team on all matters of importance. Security Operations & Incident Response (20%): Build and mature the firm's security operations capability across monitoring, threat detection, and response. Own the incident response program end to end - preparation, detection, containment, eradication, recovery, and post-incident review. Coordinate incident handling with Legal, Communications, leadership, regulators, carriers, and affected partners as appropriate. Lead security awareness and training programs across the organization, including phishing simulations, to build a security-conscious workforce. Continuously monitor the threat landscape and adjust the firm's defenses, controls, and priorities accordingly. Personally own and operate the firm's day-to-day security functions in a hands-on capacity, instilling practices that mirror the adopted core values of the company. Bottom line: help build an amazing, resilient company. Leadership, Culture & Team Building (5%): Assure a team mentality and culture: partner effectively across the company to drive our culture and execute on our common goals. Act as a trusted security partner and advisor to every team, embedding security into how the whole company works rather than relying on a large dedicated staff. Manage periodic employee communications on security and risk matters. Collaborate with senior leadership on related projects as they arise and in meeting overall deliverables. Communicate with co-workers, management, clients and others in a courteous and professional manner. Education, Skill and Experience Required A minimum of 7-15 years of experience in information security / cybersecurity, with a history of upward progression working up through the ranks into senior leadership. Financial services, insurance, and/or fintech and start-up experience strongly preferred. Must have a minimum of a bachelor's degree (Computer Science, Information Security, or a related field). Master's degree or MBA preferred. Industry security certifications strongly preferred (e.g., CISSP, CISM, CRISC, CISA, or CCSP). Must have direct, hands on experience building or running an enterprise information security program, ideally from an early stage, including hands-on execution across multiple security domains. Must have a strong background in cloud security and API security coupled with secure SDLC / DevSecOps and application/product -security experience. Demonstrated expertise across security frameworks and regulations relevant to financial services and insurance (e.g., SOC 2, NIST, ISO 27001, GLBA, CCPA). Proven experience leading incident response and managing security incidents through to resolution. Experience owning third-party / vendor risk in a heavily integrated platform environment. Responsible for developing and managing security budgets, dashboards, and roadmaps. Requires strong leadership skills as well as the ability to approach situations from an entrepreneurial point of view. Comfortable operating hands-on as effectively a team of one initially, with the demonstrated ability to build, hire, manage, and develop a security team as the function grows. Previous experience in a client-facing role with the ability to effectively communicate with all levels of employees, including board members and C-level executives, as well as auditors, regulators, and partners. . click apply for full job details
10/24/2026
Full time
Job Description Job Description About Us: FIDx is a groundbreaking, industry-changing, growing company out of Berwyn, Pennsylvania. We provide a platform that allows financial advisors to fully integrate annuities into the advisory ecosystem and modernizes annuity distribution. We do this by providing a top technology and services platform that connects the legacy tools, experience and expertise of high-quality insurance companies to the advisory marketplace. About the Opportunity: The Head of Information Security plays a critical role in protecting FIDx's platform, data, and reputation as the company scales its mission of modernizing annuity distribution. As a senior security leader in the firm, the Head of Information Security is responsible for defining and executing the company's information security, data privacy, and cyber-risk strategy - safeguarding the sensitive financial and personal data that flows across our platform and our deep integrations with carriers, advisors, and partners. This position brings executive security experience, an execution mindset, and a bias toward action to embed security into every layer of the business. The role reports to the Chief Technology Officer, with regular, direct engagement with the CEO, executive team, and Board on matters of risk and security posture. The position encompasses a wide range of activities with involvement in all phases of security governance, risk and compliance, security architecture, security operations, and incident response. It requires exemplary energy and work ethic, excellent people skills, and business acumen. The Head of Information Security is responsible for planning, organizing, directing and controlling the day-to-day security operations of the firm, and for directing the implementation of the firm's security policies - balancing rigorous protection with the speed and agility of a growing fintech. As an early-stage, small company, FIDx expects this to be a hands-on, roll-up-your-sleeves role. Out of the gate the Head of Information Security will personally own and operate the security function - effectively a team of one - doing the work directly rather than managing others who do it. As the company scales, this leader will have both the opportunity and the responsibility to build, hire, and lead a dedicated security team. This is an engaging position for a dynamic self-starter that requires significant attention to detail, entrepreneurial thinking and efficient and effective decision making. This person is entrepreneurial, self-directed and passionate about protecting the experiences we deliver to customers, advisors, investors, clients, and employees. Essential Functions Own and operate the firm's information security program, and serve as the firm's primary subject matter expert on cybersecurity, data privacy, and information-security compliance. Establish, own, and continuously mature the enterprise information security program, including policies, standards, and controls, for approval by the CTO and executive team. Support strategic planning for the future and assessing the security implications of new product lines, markets, and partnerships, and recommending how to pursue them securely. Build a strong understanding of both the technology and business aspects of the product, as security must enable delivery of the platform rather than impede it. Run the company's day-to-day security operations, creating security strategies and policies, communicating them across the organization, and building company-wide alignment with a security-first culture. Security Strategy, Architecture & Execution (35%): Build and execute the information security roadmap in alignment with the strategy and priorities set with the CTO and executive team. Work directly with development and DevOps staff to embed security into the SDLC - secure-by-design principles, secure coding standards, code review, and dependency/supply-chain management. Provide hands-on technical guidance to scrum teams as necessary to ensure security requirements are met without compromising delivery deadlines. Define and maintain security architecture across cloud infrastructure, APIs, and the application layer; establish standards for identity and access management (IAM), encryption, key management, and data protection. Set comprehensive goals for security performance and maturity; select, implement, and manage the security toolchain (e.g., SIEM, vulnerability management, endpoint protection, cloud security posture management). Run threat modeling, penetration testing, and vulnerability management programs, and drive timely remediation. Partner with Product and Engineering to ensure new products, features, and integrations are delivered securely. Lead day-to-day Security functions in partnership with the CTO and DevOps, ensuring our technology and processes are secure and meet audit requirements. Risk Management, Compliance & Audit (40%): Run the enterprise cyber-risk management program: identify, assess, prioritize, and mitigate information-security and data-privacy risks, and maintain a clear risk register. Ensure compliance with applicable regulatory and industry frameworks relevant to insurance and financial services (e.g., SOC 2, NIST CSF / 800-53, ISO 27001, GLBA, and state privacy laws such as CCPA). Manage and coordinate internal and external audits, regulatory examinations, and client and partner security assessments; maintain evidence and drive remediation of findings. Run third-party and vendor risk management, including due diligence and ongoing monitoring of partners, carriers, cloud providers, and platform integrations. Support and maintain data privacy and data governance programs. Develop, maintain, and regularly test business continuity and disaster recovery plans. Provide timely, accurate and complete reporting, dashboards, and metrics on the firm's security and risk posture; write and submit reports to the CTO and executive team on all matters of importance. Security Operations & Incident Response (20%): Build and mature the firm's security operations capability across monitoring, threat detection, and response. Own the incident response program end to end - preparation, detection, containment, eradication, recovery, and post-incident review. Coordinate incident handling with Legal, Communications, leadership, regulators, carriers, and affected partners as appropriate. Lead security awareness and training programs across the organization, including phishing simulations, to build a security-conscious workforce. Continuously monitor the threat landscape and adjust the firm's defenses, controls, and priorities accordingly. Personally own and operate the firm's day-to-day security functions in a hands-on capacity, instilling practices that mirror the adopted core values of the company. Bottom line: help build an amazing, resilient company. Leadership, Culture & Team Building (5%): Assure a team mentality and culture: partner effectively across the company to drive our culture and execute on our common goals. Act as a trusted security partner and advisor to every team, embedding security into how the whole company works rather than relying on a large dedicated staff. Manage periodic employee communications on security and risk matters. Collaborate with senior leadership on related projects as they arise and in meeting overall deliverables. Communicate with co-workers, management, clients and others in a courteous and professional manner. Education, Skill and Experience Required A minimum of 7-15 years of experience in information security / cybersecurity, with a history of upward progression working up through the ranks into senior leadership. Financial services, insurance, and/or fintech and start-up experience strongly preferred. Must have a minimum of a bachelor's degree (Computer Science, Information Security, or a related field). Master's degree or MBA preferred. Industry security certifications strongly preferred (e.g., CISSP, CISM, CRISC, CISA, or CCSP). Must have direct, hands on experience building or running an enterprise information security program, ideally from an early stage, including hands-on execution across multiple security domains. Must have a strong background in cloud security and API security coupled with secure SDLC / DevSecOps and application/product -security experience. Demonstrated expertise across security frameworks and regulations relevant to financial services and insurance (e.g., SOC 2, NIST, ISO 27001, GLBA, CCPA). Proven experience leading incident response and managing security incidents through to resolution. Experience owning third-party / vendor risk in a heavily integrated platform environment. Responsible for developing and managing security budgets, dashboards, and roadmaps. Requires strong leadership skills as well as the ability to approach situations from an entrepreneurial point of view. Comfortable operating hands-on as effectively a team of one initially, with the demonstrated ability to build, hire, manage, and develop a security team as the function grows. Previous experience in a client-facing role with the ability to effectively communicate with all levels of employees, including board members and C-level executives, as well as auditors, regulators, and partners. . click apply for full job details
Job Description Job Description Job Title: Security Control Assessor Location: On Site in Arlington, VA Department: Cyber Security Services Reports To: Management FLSA Status: Full Time/Non-exempt Clearance: Top Secret clearance with the ability to obtain SCI with CI Polygraph Job Purpose: The security control assessor (SCAs) supports a critical, objective role to evaluate the effectiveness of implemented controls in mitigating security risks. The SCA will support a critical mission within the intelligence community. In the role as a SCA, you are expected to use automated scanning tools, manual techniques, and specialized testing methodologies to identify weaknesses and vulnerabilities. The SCA is expected to be a collaborative member of the RMF program of the organization, to provide intelligent input to system security architectures in order to align with RMF principles and guidelines. This includes ensuring to guide the RMF process so that security controls are integrated seamlessly into system designs to provide comprehensive protection against threats and vulnerabilities. Duties & Responsibilities: The SCA's specific duties include: Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Ensure security assessments are completed for each IS. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the CISO and AO under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop the continuous monitoring plan specific to the information system. The SCA is responsible for the RMF deliverables associated with Step 4 of DOD and IC RMF Policies for assigned systems. This includes, but is not limited to: Security Assessment Plans tailored to specific systems control requirements Security control assessment input, which includes narratives for the review of controls and artifacts Security Assessment Reports ATO recommendations or ATO with Condition Memorandums Conduct initial remediation actions once a security assessment has been completed to ensure proper hand off to the ISSM and ISSOs. Assessment of selected controls IAW continuous monitoring strategy The SCA is expected to have additional duties as assigned in support of corporate cyber security services. Additional details are reviewed in accordance with company policies. Requirements Required Skills & Experience: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings Qualifications: Bachelor's Degree in Computer Science or a related technical discipline Master's Degree preferred. Minimum 6-10 years of experience. Must currently possess an active Top Secret clearance with the ability to obtain SCI with CI Polygraph. DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) is required Systems Security Engineering background preferred. Effective communication skills to collaborate with cross-functional teams and stakeholders on implementing security measures organization-wide. Strong analytical skills for identifying system vulnerabilities and documenting control remediation recommendations through collaboration on System Impact Analysis and Documented Risk Acceptance. Detail-oriented with the ability to manage multiple tasks and prioritize effectively. Comprehensive knowledge of RMF activities at a senior level (ability to articulate to Executive audiences preferred). Familiarity with federal regulatory requirements, contractual obligations, and industry standards related to information security. Evaluate adherence to standards such as Privacy, GDPR, and HIPAA Powered by JazzHR I48iVzr4Ds
10/23/2026
Full time
Job Description Job Description Job Title: Security Control Assessor Location: On Site in Arlington, VA Department: Cyber Security Services Reports To: Management FLSA Status: Full Time/Non-exempt Clearance: Top Secret clearance with the ability to obtain SCI with CI Polygraph Job Purpose: The security control assessor (SCAs) supports a critical, objective role to evaluate the effectiveness of implemented controls in mitigating security risks. The SCA will support a critical mission within the intelligence community. In the role as a SCA, you are expected to use automated scanning tools, manual techniques, and specialized testing methodologies to identify weaknesses and vulnerabilities. The SCA is expected to be a collaborative member of the RMF program of the organization, to provide intelligent input to system security architectures in order to align with RMF principles and guidelines. This includes ensuring to guide the RMF process so that security controls are integrated seamlessly into system designs to provide comprehensive protection against threats and vulnerabilities. Duties & Responsibilities: The SCA's specific duties include: Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Ensure security assessments are completed for each IS. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the CISO and AO under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop the continuous monitoring plan specific to the information system. The SCA is responsible for the RMF deliverables associated with Step 4 of DOD and IC RMF Policies for assigned systems. This includes, but is not limited to: Security Assessment Plans tailored to specific systems control requirements Security control assessment input, which includes narratives for the review of controls and artifacts Security Assessment Reports ATO recommendations or ATO with Condition Memorandums Conduct initial remediation actions once a security assessment has been completed to ensure proper hand off to the ISSM and ISSOs. Assessment of selected controls IAW continuous monitoring strategy The SCA is expected to have additional duties as assigned in support of corporate cyber security services. Additional details are reviewed in accordance with company policies. Requirements Required Skills & Experience: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings Qualifications: Bachelor's Degree in Computer Science or a related technical discipline Master's Degree preferred. Minimum 6-10 years of experience. Must currently possess an active Top Secret clearance with the ability to obtain SCI with CI Polygraph. DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) is required Systems Security Engineering background preferred. Effective communication skills to collaborate with cross-functional teams and stakeholders on implementing security measures organization-wide. Strong analytical skills for identifying system vulnerabilities and documenting control remediation recommendations through collaboration on System Impact Analysis and Documented Risk Acceptance. Detail-oriented with the ability to manage multiple tasks and prioritize effectively. Comprehensive knowledge of RMF activities at a senior level (ability to articulate to Executive audiences preferred). Familiarity with federal regulatory requirements, contractual obligations, and industry standards related to information security. Evaluate adherence to standards such as Privacy, GDPR, and HIPAA Powered by JazzHR I48iVzr4Ds
Job Description Job Description Description: Job Title: Security Control Assessor Location: On Site in Arlington, VA Department: Cyber Security Services Reports To: Management FLSA Status: Full Time/Non-exempt Job Purpose: The security control assessor (SCAs) supports a critical, objective role to evaluate the effectiveness of implemented controls in mitigating security risks. The SCA will support a critical mission within the intelligence community. In the role as a SCA, you are expected to use automated scanning tools, manual techniques, and specialized testing methodologies to identify weaknesses and vulnerabilities. The SCA is expected to be a collaborative member of the RMF program of the organization, to provide intelligent input to system security architectures in order to align with RMF principles and guidelines. This includes ensuring to guide the RMF process so that security controls are integrated seamlessly into system designs to provide comprehensive protection against threats and vulnerabilities. Duties & Responsibilities: The SCA's specific duties include: Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Ensure security assessments are completed for each IS. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the CISO and AO under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop the continuous monitoring plan specific to the information system. The SCA is responsible for the RMF deliverables associated with Step 4 of DOD and IC RMF Policies for assigned systems. This includes, but is not limited to: Security Assessment Plans tailored to specific systems control requirements Security control assessment input, which includes narratives for the review of controls and artifacts Security Assessment Reports ATO recommendations or ATO with Condition Memorandums Conduct initial remediation actions once a security assessment has been completed to ensure proper hand off to the ISSM and ISSOs. Assessment of selected controls IAW continuous monitoring strategy The SCA is expected to have additional duties as assigned in support of corporate cyber security services. Additional details are reviewed in accordance with company policies. Requirements: Required Skills & Experience: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings Qualifications: Bachelor's Degree in Computer Science or a related technical discipline Master's Degree preferred. Minimum 6-10 years of experience. Must currently possess an active TS/SCI with the ability to obtain and maintain a CI polygraph. DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) is required Systems Security Engineering background preferred. Effective communication skills to collaborate with cross-functional teams and stakeholders on implementing security measures organization-wide. Strong analytical skills for identifying system vulnerabilities and documenting control remediation recommendations through collaboration on System Impact Analysis and Documented Risk Acceptance. Detail-oriented with the ability to manage multiple tasks and prioritize effectively. Comprehensive knowledge of RMF activities at a senior level (ability to articulate to Executive audiences preferred). Familiarity with federal regulatory requirements, contractual obligations, and industry standards related to information security. Evaluate adherence to standards such as Privacy, GDPR, and HIPAA Other: This is typical office or administrative work, and there is no exposure to adverse environmental conditions. This position requires sedentary work. Sedentary work is defined as: Exerting up to 10 pounds of force occasionally and/or a negligible amount of force frequently or constantly to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time. Jobs are sedentary if walking and standing are required only occasionally, and all other sedentary criteria are met.
10/21/2026
Full time
Job Description Job Description Description: Job Title: Security Control Assessor Location: On Site in Arlington, VA Department: Cyber Security Services Reports To: Management FLSA Status: Full Time/Non-exempt Job Purpose: The security control assessor (SCAs) supports a critical, objective role to evaluate the effectiveness of implemented controls in mitigating security risks. The SCA will support a critical mission within the intelligence community. In the role as a SCA, you are expected to use automated scanning tools, manual techniques, and specialized testing methodologies to identify weaknesses and vulnerabilities. The SCA is expected to be a collaborative member of the RMF program of the organization, to provide intelligent input to system security architectures in order to align with RMF principles and guidelines. This includes ensuring to guide the RMF process so that security controls are integrated seamlessly into system designs to provide comprehensive protection against threats and vulnerabilities. Duties & Responsibilities: The SCA's specific duties include: Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Ensure security assessments are completed for each IS. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the CISO and AO under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop the continuous monitoring plan specific to the information system. The SCA is responsible for the RMF deliverables associated with Step 4 of DOD and IC RMF Policies for assigned systems. This includes, but is not limited to: Security Assessment Plans tailored to specific systems control requirements Security control assessment input, which includes narratives for the review of controls and artifacts Security Assessment Reports ATO recommendations or ATO with Condition Memorandums Conduct initial remediation actions once a security assessment has been completed to ensure proper hand off to the ISSM and ISSOs. Assessment of selected controls IAW continuous monitoring strategy The SCA is expected to have additional duties as assigned in support of corporate cyber security services. Additional details are reviewed in accordance with company policies. Requirements: Required Skills & Experience: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings Qualifications: Bachelor's Degree in Computer Science or a related technical discipline Master's Degree preferred. Minimum 6-10 years of experience. Must currently possess an active TS/SCI with the ability to obtain and maintain a CI polygraph. DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) is required Systems Security Engineering background preferred. Effective communication skills to collaborate with cross-functional teams and stakeholders on implementing security measures organization-wide. Strong analytical skills for identifying system vulnerabilities and documenting control remediation recommendations through collaboration on System Impact Analysis and Documented Risk Acceptance. Detail-oriented with the ability to manage multiple tasks and prioritize effectively. Comprehensive knowledge of RMF activities at a senior level (ability to articulate to Executive audiences preferred). Familiarity with federal regulatory requirements, contractual obligations, and industry standards related to information security. Evaluate adherence to standards such as Privacy, GDPR, and HIPAA Other: This is typical office or administrative work, and there is no exposure to adverse environmental conditions. This position requires sedentary work. Sedentary work is defined as: Exerting up to 10 pounds of force occasionally and/or a negligible amount of force frequently or constantly to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time. Jobs are sedentary if walking and standing are required only occasionally, and all other sedentary criteria are met.
Job Description Job Description State Street Work from any major hub Quincy, Massachusetts Berwyn, Pennsylvania Clifton, New Jersey Austin, Texas Salary Range: $120,000 - $217,500 Annual Who we are looking for We are seeking a highly technical and hands on Security Guardian, Vice President to serve as a strategic security guardian to engineering, platform, and business teams. This role sits in the first line of defense and is responsible for proactively reducing technical security risk through deep engagement with product teams, rigorous architecture and application reviews, and the design and validation of embedded security controls across cloud and distributed environments. Why this role is important to us The ideal candidate is an experienced security architect and practitioner who thrives working directly with engineers, thinks like an attacker, and can translate complex security principles into actionable engineering decisions. This person brings strong expertise across multiple advanced security domains and operates as both a technical advisor and a strategic influencer. What you will be responsible for Conduct hands-on security assessments at the application, platform, and system levels using threat modeling, architecture review, and vulnerability analysis to identify design flaws, cloud misconfigurations, insecure dependencies, and agent or API abuse scenarios. Design and recommend concrete security controls that are embedded directly into system and application architectures, including secure identity and access design, cryptographic protections, network isolation, runtime enforcement, and secure defaults across cloud and distributed environments. Own and actively drive down technical security risk by continuously engaging with engineering and platform teams, validating that security controls are correctly implemented, effective in production, and aligned with real-world threat models rather than static risk registers. Partner closely with engineering teams as an embedded product security expert, influencing design decisions early, reviewing architecture and code paths, and helping teams build secure systems by default rather than retrofitting controls. Provide technically grounded security guidance to senior leadership, translating complex security tradeoffs into clear engineering decisions and recommending concrete mitigation strategies based on architecture, cloud primitives, cryptographic design, and secure software delivery practices. Demonstrate deep, hands-on expertise in at least three advanced security domains, such as product security, smart contract and blockchain security, multi-cloud security, threat modeling, secure architecture and design, Agentic AI security, and software supply-chain security. Bring strong technical depth across network security, product and platform security, data protection and cryptography, and offensive security techniques, using attacker-mindset analysis to proactively identify and remediate weaknesses before exploitation. Operate effectively within agile engineering environments, embedding security into iterative delivery through DevSecOps and Shift-Left principles, automated security testing, secure CI/CD pipelines, and rapid, evidence-based decision-making. Demonstrate strong written and oral communication skills, effectively engaging with engineers, architects, and platform teams on deep technical security topics while clearly articulating security risks, design tradeoffs, and remediation strategies to business and executive stakeholders in a concise, actionable manner. What we value These skills will help you succeed in this role Strong analytical and problem-solving skills, excellent communication (written and verbal) and advisory skills, attention to detail, ability to work independently and in teams, adaptability, and ethical judgment. Demonstrate strategic and tactical thinking, along with decision-making skills and business acumen. Be organized, reliable and have a strong bias for action. Education & Preferred Qualifications At least 7+ years of progressive cybersecurity experience with focus in Product and Cloud security and 3+ years within financial services. Experience in Agentic AI security and smart contract security is highly preferred. AWS or Azure Cloud Security certification is highly valued. Bachelor's degree in Computer Science or related technical field. Professional certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and GIAC are preferred. Proven experience collaborating with engineering teams in an embedded security engagement model.
10/20/2026
Full time
Job Description Job Description State Street Work from any major hub Quincy, Massachusetts Berwyn, Pennsylvania Clifton, New Jersey Austin, Texas Salary Range: $120,000 - $217,500 Annual Who we are looking for We are seeking a highly technical and hands on Security Guardian, Vice President to serve as a strategic security guardian to engineering, platform, and business teams. This role sits in the first line of defense and is responsible for proactively reducing technical security risk through deep engagement with product teams, rigorous architecture and application reviews, and the design and validation of embedded security controls across cloud and distributed environments. Why this role is important to us The ideal candidate is an experienced security architect and practitioner who thrives working directly with engineers, thinks like an attacker, and can translate complex security principles into actionable engineering decisions. This person brings strong expertise across multiple advanced security domains and operates as both a technical advisor and a strategic influencer. What you will be responsible for Conduct hands-on security assessments at the application, platform, and system levels using threat modeling, architecture review, and vulnerability analysis to identify design flaws, cloud misconfigurations, insecure dependencies, and agent or API abuse scenarios. Design and recommend concrete security controls that are embedded directly into system and application architectures, including secure identity and access design, cryptographic protections, network isolation, runtime enforcement, and secure defaults across cloud and distributed environments. Own and actively drive down technical security risk by continuously engaging with engineering and platform teams, validating that security controls are correctly implemented, effective in production, and aligned with real-world threat models rather than static risk registers. Partner closely with engineering teams as an embedded product security expert, influencing design decisions early, reviewing architecture and code paths, and helping teams build secure systems by default rather than retrofitting controls. Provide technically grounded security guidance to senior leadership, translating complex security tradeoffs into clear engineering decisions and recommending concrete mitigation strategies based on architecture, cloud primitives, cryptographic design, and secure software delivery practices. Demonstrate deep, hands-on expertise in at least three advanced security domains, such as product security, smart contract and blockchain security, multi-cloud security, threat modeling, secure architecture and design, Agentic AI security, and software supply-chain security. Bring strong technical depth across network security, product and platform security, data protection and cryptography, and offensive security techniques, using attacker-mindset analysis to proactively identify and remediate weaknesses before exploitation. Operate effectively within agile engineering environments, embedding security into iterative delivery through DevSecOps and Shift-Left principles, automated security testing, secure CI/CD pipelines, and rapid, evidence-based decision-making. Demonstrate strong written and oral communication skills, effectively engaging with engineers, architects, and platform teams on deep technical security topics while clearly articulating security risks, design tradeoffs, and remediation strategies to business and executive stakeholders in a concise, actionable manner. What we value These skills will help you succeed in this role Strong analytical and problem-solving skills, excellent communication (written and verbal) and advisory skills, attention to detail, ability to work independently and in teams, adaptability, and ethical judgment. Demonstrate strategic and tactical thinking, along with decision-making skills and business acumen. Be organized, reliable and have a strong bias for action. Education & Preferred Qualifications At least 7+ years of progressive cybersecurity experience with focus in Product and Cloud security and 3+ years within financial services. Experience in Agentic AI security and smart contract security is highly preferred. AWS or Azure Cloud Security certification is highly valued. Bachelor's degree in Computer Science or related technical field. Professional certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and GIAC are preferred. Proven experience collaborating with engineering teams in an embedded security engagement model.
Wilson Elser - Business & Legal Professionals
New York, New York
Job Description Job Description At Wilson Elser, we are redefining what it means to work at a national law firm. With more than 1,400 attorneys across 46 offices nationwide, we are recognized among the top 100 law firms by The American Lawyer and ranked in the National Law Journal's survey of the nation's largest law firms. Our continued success is built on a culture of collaboration, innovation, client service, and mutual respect. We are committed to fostering an environment where employees are empowered to grow their careers, contribute meaningfully, and thrive professionally. The Position We are seeking a highly skilled Senior Application Security Engineer to help establish and mature our secure software development and DevSecOps program. This role will serve as the bridge between Information Security and Application Development, partnering closely with engineering leadership to embed security into the software development lifecycle without slowing innovation or delivery. This individual will work across internally developed applications, cloud-native platforms, CI/CD pipelines, integrations, low-code/no-code platforms, and Azure-hosted services. The ideal candidate combines hands-on application security expertise with practical development experience and strong collaboration skills. This position will report to the Information Security team with a strong dotted-line partnership into Application Development and Engineering leadership. Key Responsibilities Application Security & Secure Development Lifecycle (SDL) Lead and mature the organization's secure software development lifecycle (SSDLC) program Partner with developers and engineering leadership to embed secure-by-design principles into development workflows Perform application security reviews, threat modeling, and secure architecture assessments Review source code and assist development teams in identifying and remediating vulnerabilities Establish secure development standards, policies, and reusable secure coding templates Build and maintain "paved road" secure development patterns for common technologies and frameworks DevSecOps & CI/CD Security Integrate and optimize security tooling within Azure DevOps pipelines Manage and improve SAST, DAST, SCA, API scanning, and IaC scanning processes Enhance automated security testing within CI/CD workflows Develop processes for vulnerability ingestion, triage, prioritization, remediation tracking, and reporting Build dashboards and metrics around application security posture and remediation SLAs Create or customize scripts and integrations to normalize findings across multiple security tools Security Tooling & Vulnerability Management Administer and optimize tools such as: Snyk SonarQube Azure DevOps PowerShell scanning tools Additional open source or commercial AppSec tooling as needed Evaluate gaps in existing security tooling coverage and recommend improvements Tune scanners, suppress false positives appropriately, and create custom detection rules where necessary Partner with development teams to manage security exceptions and remediation timelines Cloud & Platform Security Collaborate with cloud and infrastructure teams to secure Azure-hosted applications and services Support security reviews involving: Azure PaaS services Containers Databricks MongoDB Data Lake environments Azure Data Factory Power Platform / Power Apps Assist with securing low-code/no-code platforms and related governance processes Security Culture & Developer Enablement Establish and support a Security Champions program within engineering teams Deliver developer-focused training, workshops, lunch-and-learns, and secure coding guidance Serve as a trusted advisor and mentor to developers on secure coding and DevSecOps practices Promote a collaborative, enablement-focused security culture Qualifications 5+ years of experience in Application Security, Product Security, DevSecOps, or Software Engineering Hands-on experience securing CI/CD pipelines and modern development workflows Experience working directly with development teams in agile environments Strong understanding of: Secure coding principles OWASP Top 10 Secure SDLC practices Threat modeling Vulnerability management Experience with at least several of the following technologies: Azure DevOps Azure cloud services Snyk SonarQube Containers/Kubernetes PowerShell Python .NET JavaScript React PHP Experience integrating security tooling into CI/CD pipelines Ability to analyze scanner results and distinguish meaningful risk from low-value findings Strong scripting and automation skills Excellent communication and collaboration skills Wilson Elser offers a competitive salary and benefits package designed to support our attorneys both professionally and personally. A variety of factors are considered in making compensation decisions, including but not limited to experience, education, licensure and/or certifications, geographic location, market demands, other business and organizational needs, and other factors permitted by law. Final salary wages offered may be outside of this range based on other reasons and individual circumstances. This position is considered full-time and therefore qualifies for benefits including 401(k) retirement savings plan, medical, dental, vision, disability, and life insurance. Details of participation in these benefit plans will be provided if an employee receives an offer of employment. Salary Range: $150,000-$180,000 USD Why Should You Apply? Benefits: Outstanding benefits package, including 401k match and generous PTO plan Career Growth: Ample opportunities for professional development and advancement Employee Perks: Access to corporate discount plans and other benefits Wilson Elser welcomes submissions of candidates for our open positions exclusively from recruitment agencies with an active, signed fee agreement who have been granted access to a position through our dedicated Recruitment Agency Portal. We are unable to consider submissions from recruitment agencies without a current (dated as of 7/1/2024) agreement in place. We appreciate your understanding. For collaboration inquiries or to establish an agreement, please contact us at . Wilson Elser is committed to a collegial work environment in which all individuals are treated with respect and dignity. It is the Firm's policy that employment will be based on merit, qualifications, and competence. Further, employment decisions will be made without regard to an applicants race, color, age, sex, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation or preference, gender identity, physical or mental disability, status as a victim of domestic violence, sex offenses, or stalking, past or present service in the uniformed services or application or obligation to serve in the uniformed services, or any other characteristic protected by law. Wilson Elser endeavors to make the Wilson Elser website accessible to any and all users. You may review our Accessibility Policy here. California Residents may review our CCPA notice for applicants and employees here. Wilson Elser participates in the federal E-Verify program. With respect to all new hires, we provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS) with information from each new employee's Form I-9 to confirm work authorization. Please review the official posters for detailed information regarding your rights and protections Download the E-Verify Participation Poster (English & Spanish) Download the Right to Work Poster (English & Spanish)
10/20/2026
Full time
Job Description Job Description At Wilson Elser, we are redefining what it means to work at a national law firm. With more than 1,400 attorneys across 46 offices nationwide, we are recognized among the top 100 law firms by The American Lawyer and ranked in the National Law Journal's survey of the nation's largest law firms. Our continued success is built on a culture of collaboration, innovation, client service, and mutual respect. We are committed to fostering an environment where employees are empowered to grow their careers, contribute meaningfully, and thrive professionally. The Position We are seeking a highly skilled Senior Application Security Engineer to help establish and mature our secure software development and DevSecOps program. This role will serve as the bridge between Information Security and Application Development, partnering closely with engineering leadership to embed security into the software development lifecycle without slowing innovation or delivery. This individual will work across internally developed applications, cloud-native platforms, CI/CD pipelines, integrations, low-code/no-code platforms, and Azure-hosted services. The ideal candidate combines hands-on application security expertise with practical development experience and strong collaboration skills. This position will report to the Information Security team with a strong dotted-line partnership into Application Development and Engineering leadership. Key Responsibilities Application Security & Secure Development Lifecycle (SDL) Lead and mature the organization's secure software development lifecycle (SSDLC) program Partner with developers and engineering leadership to embed secure-by-design principles into development workflows Perform application security reviews, threat modeling, and secure architecture assessments Review source code and assist development teams in identifying and remediating vulnerabilities Establish secure development standards, policies, and reusable secure coding templates Build and maintain "paved road" secure development patterns for common technologies and frameworks DevSecOps & CI/CD Security Integrate and optimize security tooling within Azure DevOps pipelines Manage and improve SAST, DAST, SCA, API scanning, and IaC scanning processes Enhance automated security testing within CI/CD workflows Develop processes for vulnerability ingestion, triage, prioritization, remediation tracking, and reporting Build dashboards and metrics around application security posture and remediation SLAs Create or customize scripts and integrations to normalize findings across multiple security tools Security Tooling & Vulnerability Management Administer and optimize tools such as: Snyk SonarQube Azure DevOps PowerShell scanning tools Additional open source or commercial AppSec tooling as needed Evaluate gaps in existing security tooling coverage and recommend improvements Tune scanners, suppress false positives appropriately, and create custom detection rules where necessary Partner with development teams to manage security exceptions and remediation timelines Cloud & Platform Security Collaborate with cloud and infrastructure teams to secure Azure-hosted applications and services Support security reviews involving: Azure PaaS services Containers Databricks MongoDB Data Lake environments Azure Data Factory Power Platform / Power Apps Assist with securing low-code/no-code platforms and related governance processes Security Culture & Developer Enablement Establish and support a Security Champions program within engineering teams Deliver developer-focused training, workshops, lunch-and-learns, and secure coding guidance Serve as a trusted advisor and mentor to developers on secure coding and DevSecOps practices Promote a collaborative, enablement-focused security culture Qualifications 5+ years of experience in Application Security, Product Security, DevSecOps, or Software Engineering Hands-on experience securing CI/CD pipelines and modern development workflows Experience working directly with development teams in agile environments Strong understanding of: Secure coding principles OWASP Top 10 Secure SDLC practices Threat modeling Vulnerability management Experience with at least several of the following technologies: Azure DevOps Azure cloud services Snyk SonarQube Containers/Kubernetes PowerShell Python .NET JavaScript React PHP Experience integrating security tooling into CI/CD pipelines Ability to analyze scanner results and distinguish meaningful risk from low-value findings Strong scripting and automation skills Excellent communication and collaboration skills Wilson Elser offers a competitive salary and benefits package designed to support our attorneys both professionally and personally. A variety of factors are considered in making compensation decisions, including but not limited to experience, education, licensure and/or certifications, geographic location, market demands, other business and organizational needs, and other factors permitted by law. Final salary wages offered may be outside of this range based on other reasons and individual circumstances. This position is considered full-time and therefore qualifies for benefits including 401(k) retirement savings plan, medical, dental, vision, disability, and life insurance. Details of participation in these benefit plans will be provided if an employee receives an offer of employment. Salary Range: $150,000-$180,000 USD Why Should You Apply? Benefits: Outstanding benefits package, including 401k match and generous PTO plan Career Growth: Ample opportunities for professional development and advancement Employee Perks: Access to corporate discount plans and other benefits Wilson Elser welcomes submissions of candidates for our open positions exclusively from recruitment agencies with an active, signed fee agreement who have been granted access to a position through our dedicated Recruitment Agency Portal. We are unable to consider submissions from recruitment agencies without a current (dated as of 7/1/2024) agreement in place. We appreciate your understanding. For collaboration inquiries or to establish an agreement, please contact us at . Wilson Elser is committed to a collegial work environment in which all individuals are treated with respect and dignity. It is the Firm's policy that employment will be based on merit, qualifications, and competence. Further, employment decisions will be made without regard to an applicants race, color, age, sex, religion, creed, national origin, ancestry, citizenship, marital status, sexual orientation or preference, gender identity, physical or mental disability, status as a victim of domestic violence, sex offenses, or stalking, past or present service in the uniformed services or application or obligation to serve in the uniformed services, or any other characteristic protected by law. Wilson Elser endeavors to make the Wilson Elser website accessible to any and all users. You may review our Accessibility Policy here. California Residents may review our CCPA notice for applicants and employees here. Wilson Elser participates in the federal E-Verify program. With respect to all new hires, we provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS) with information from each new employee's Form I-9 to confirm work authorization. Please review the official posters for detailed information regarding your rights and protections Download the E-Verify Participation Poster (English & Spanish) Download the Right to Work Poster (English & Spanish)
Job Description Job Description Job Title: Security Control Assessor Location: On Site in Arlington, VA Department: Cyber Security Services Reports To: Management FLSA Status: Full Time/Non-exempt Clearance: Top Secret clearance with the ability to obtain SCI with CI Polygraph Job Purpose: The security control assessor (SCAs) supports a critical, objective role to evaluate the effectiveness of implemented controls in mitigating security risks. The SCA will support a critical mission within the intelligence community. In the role as a SCA, you are expected to use automated scanning tools, manual techniques, and specialized testing methodologies to identify weaknesses and vulnerabilities. The SCA is expected to be a collaborative member of the RMF program of the organization, to provide intelligent input to system security architectures in order to align with RMF principles and guidelines. This includes ensuring to guide the RMF process so that security controls are integrated seamlessly into system designs to provide comprehensive protection against threats and vulnerabilities. Duties & Responsibilities: The SCA's specific duties include: Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Ensure security assessments are completed for each IS. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the CISO and AO under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop the continuous monitoring plan specific to the information system. The SCA is responsible for the RMF deliverables associated with Step 4 of DOD and IC RMF Policies for assigned systems. This includes, but is not limited to: Security Assessment Plans tailored to specific systems control requirements Security control assessment input, which includes narratives for the review of controls and artifacts Security Assessment Reports ATO recommendations or ATO with Condition Memorandums Conduct initial remediation actions once a security assessment has been completed to ensure proper hand off to the ISSM and ISSOs. Assessment of selected controls IAW continuous monitoring strategy The SCA is expected to have additional duties as assigned in support of corporate cyber security services. Additional details are reviewed in accordance with company policies. Requirements Required Skills & Experience: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings Qualifications: Bachelor's Degree in Computer Science or a related technical discipline Master's Degree preferred. Minimum 6-10 years of experience. Must currently possess an active Top Secret clearance with the ability to obtain SCI with CI Polygraph. DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) is required Systems Security Engineering background preferred. Effective communication skills to collaborate with cross-functional teams and stakeholders on implementing security measures organization-wide. Strong analytical skills for identifying system vulnerabilities and documenting control remediation recommendations through collaboration on System Impact Analysis and Documented Risk Acceptance. Detail-oriented with the ability to manage multiple tasks and prioritize effectively. Comprehensive knowledge of RMF activities at a senior level (ability to articulate to Executive audiences preferred). Familiarity with federal regulatory requirements, contractual obligations, and industry standards related to information security. Evaluate adherence to standards such as Privacy, GDPR, and HIPAA Powered by JazzHR I48iVzr4Ds
09/26/2026
Full time
Job Description Job Description Job Title: Security Control Assessor Location: On Site in Arlington, VA Department: Cyber Security Services Reports To: Management FLSA Status: Full Time/Non-exempt Clearance: Top Secret clearance with the ability to obtain SCI with CI Polygraph Job Purpose: The security control assessor (SCAs) supports a critical, objective role to evaluate the effectiveness of implemented controls in mitigating security risks. The SCA will support a critical mission within the intelligence community. In the role as a SCA, you are expected to use automated scanning tools, manual techniques, and specialized testing methodologies to identify weaknesses and vulnerabilities. The SCA is expected to be a collaborative member of the RMF program of the organization, to provide intelligent input to system security architectures in order to align with RMF principles and guidelines. This includes ensuring to guide the RMF process so that security controls are integrated seamlessly into system designs to provide comprehensive protection against threats and vulnerabilities. Duties & Responsibilities: The SCA's specific duties include: Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Ensure security assessments are completed for each IS. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the CISO and AO under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop the continuous monitoring plan specific to the information system. The SCA is responsible for the RMF deliverables associated with Step 4 of DOD and IC RMF Policies for assigned systems. This includes, but is not limited to: Security Assessment Plans tailored to specific systems control requirements Security control assessment input, which includes narratives for the review of controls and artifacts Security Assessment Reports ATO recommendations or ATO with Condition Memorandums Conduct initial remediation actions once a security assessment has been completed to ensure proper hand off to the ISSM and ISSOs. Assessment of selected controls IAW continuous monitoring strategy The SCA is expected to have additional duties as assigned in support of corporate cyber security services. Additional details are reviewed in accordance with company policies. Requirements Required Skills & Experience: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings Qualifications: Bachelor's Degree in Computer Science or a related technical discipline Master's Degree preferred. Minimum 6-10 years of experience. Must currently possess an active Top Secret clearance with the ability to obtain SCI with CI Polygraph. DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) is required Systems Security Engineering background preferred. Effective communication skills to collaborate with cross-functional teams and stakeholders on implementing security measures organization-wide. Strong analytical skills for identifying system vulnerabilities and documenting control remediation recommendations through collaboration on System Impact Analysis and Documented Risk Acceptance. Detail-oriented with the ability to manage multiple tasks and prioritize effectively. Comprehensive knowledge of RMF activities at a senior level (ability to articulate to Executive audiences preferred). Familiarity with federal regulatory requirements, contractual obligations, and industry standards related to information security. Evaluate adherence to standards such as Privacy, GDPR, and HIPAA Powered by JazzHR I48iVzr4Ds
Job Description Job Description Description: Job Title: Security Control Assessor Location: On Site in Arlington, VA Department: Cyber Security Services Reports To: Management FLSA Status: Full Time/Non-exempt Job Purpose: The security control assessor (SCAs) supports a critical, objective role to evaluate the effectiveness of implemented controls in mitigating security risks. The SCA will support a critical mission within the intelligence community. In the role as a SCA, you are expected to use automated scanning tools, manual techniques, and specialized testing methodologies to identify weaknesses and vulnerabilities. The SCA is expected to be a collaborative member of the RMF program of the organization, to provide intelligent input to system security architectures in order to align with RMF principles and guidelines. This includes ensuring to guide the RMF process so that security controls are integrated seamlessly into system designs to provide comprehensive protection against threats and vulnerabilities. Duties & Responsibilities: The SCA's specific duties include: Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Ensure security assessments are completed for each IS. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the CISO and AO under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop the continuous monitoring plan specific to the information system. The SCA is responsible for the RMF deliverables associated with Step 4 of DOD and IC RMF Policies for assigned systems. This includes, but is not limited to: Security Assessment Plans tailored to specific systems control requirements Security control assessment input, which includes narratives for the review of controls and artifacts Security Assessment Reports ATO recommendations or ATO with Condition Memorandums Conduct initial remediation actions once a security assessment has been completed to ensure proper hand off to the ISSM and ISSOs. Assessment of selected controls IAW continuous monitoring strategy The SCA is expected to have additional duties as assigned in support of corporate cyber security services. Additional details are reviewed in accordance with company policies. Requirements: Required Skills & Experience: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings Qualifications: Bachelor's Degree in Computer Science or a related technical discipline Master's Degree preferred. Minimum 6-10 years of experience. Must currently possess an active TS/SCI with the ability to obtain and maintain a CI polygraph. DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) is required Systems Security Engineering background preferred. Effective communication skills to collaborate with cross-functional teams and stakeholders on implementing security measures organization-wide. Strong analytical skills for identifying system vulnerabilities and documenting control remediation recommendations through collaboration on System Impact Analysis and Documented Risk Acceptance. Detail-oriented with the ability to manage multiple tasks and prioritize effectively. Comprehensive knowledge of RMF activities at a senior level (ability to articulate to Executive audiences preferred). Familiarity with federal regulatory requirements, contractual obligations, and industry standards related to information security. Evaluate adherence to standards such as Privacy, GDPR, and HIPAA Other: This is typical office or administrative work, and there is no exposure to adverse environmental conditions. This position requires sedentary work. Sedentary work is defined as: Exerting up to 10 pounds of force occasionally and/or a negligible amount of force frequently or constantly to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time. Jobs are sedentary if walking and standing are required only occasionally, and all other sedentary criteria are met.
09/26/2026
Full time
Job Description Job Description Description: Job Title: Security Control Assessor Location: On Site in Arlington, VA Department: Cyber Security Services Reports To: Management FLSA Status: Full Time/Non-exempt Job Purpose: The security control assessor (SCAs) supports a critical, objective role to evaluate the effectiveness of implemented controls in mitigating security risks. The SCA will support a critical mission within the intelligence community. In the role as a SCA, you are expected to use automated scanning tools, manual techniques, and specialized testing methodologies to identify weaknesses and vulnerabilities. The SCA is expected to be a collaborative member of the RMF program of the organization, to provide intelligent input to system security architectures in order to align with RMF principles and guidelines. This includes ensuring to guide the RMF process so that security controls are integrated seamlessly into system designs to provide comprehensive protection against threats and vulnerabilities. Duties & Responsibilities: The SCA's specific duties include: Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Ensure security assessments are completed for each IS. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the CISO and AO under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop the continuous monitoring plan specific to the information system. The SCA is responsible for the RMF deliverables associated with Step 4 of DOD and IC RMF Policies for assigned systems. This includes, but is not limited to: Security Assessment Plans tailored to specific systems control requirements Security control assessment input, which includes narratives for the review of controls and artifacts Security Assessment Reports ATO recommendations or ATO with Condition Memorandums Conduct initial remediation actions once a security assessment has been completed to ensure proper hand off to the ISSM and ISSOs. Assessment of selected controls IAW continuous monitoring strategy The SCA is expected to have additional duties as assigned in support of corporate cyber security services. Additional details are reviewed in accordance with company policies. Requirements: Required Skills & Experience: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings Qualifications: Bachelor's Degree in Computer Science or a related technical discipline Master's Degree preferred. Minimum 6-10 years of experience. Must currently possess an active TS/SCI with the ability to obtain and maintain a CI polygraph. DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) is required Systems Security Engineering background preferred. Effective communication skills to collaborate with cross-functional teams and stakeholders on implementing security measures organization-wide. Strong analytical skills for identifying system vulnerabilities and documenting control remediation recommendations through collaboration on System Impact Analysis and Documented Risk Acceptance. Detail-oriented with the ability to manage multiple tasks and prioritize effectively. Comprehensive knowledge of RMF activities at a senior level (ability to articulate to Executive audiences preferred). Familiarity with federal regulatory requirements, contractual obligations, and industry standards related to information security. Evaluate adherence to standards such as Privacy, GDPR, and HIPAA Other: This is typical office or administrative work, and there is no exposure to adverse environmental conditions. This position requires sedentary work. Sedentary work is defined as: Exerting up to 10 pounds of force occasionally and/or a negligible amount of force frequently or constantly to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time. Jobs are sedentary if walking and standing are required only occasionally, and all other sedentary criteria are met.