Senior Control Assessment Analyst

Edgewater Federal Solutions seeks an experienced Senior Control Assessment Analyst to support Assessment and Authorization (A&A) program which operates in alignment with the NIST Risk Management Framework (RMF) as outlined in the current release of NIST SP 800-37. The objective of Control Assessment task is to provide security subject matter expertise to develop A&A methodologies, maintain accurate assessment schedules, and conduct control assessment activities for newly developed or acquired information systems, as well as for systems and common controls in ongoing authorization.

This work will be conducted onsite in Washington, DC.

• Assessment Methodology:
  • Develop a methodology for conducting control assessments for software-as-a-service (SaaS) solutions operated by a vendor on behalf of the client that has not received FedRAMP authorization, and assess external organizations and systems that process, store, or transmit information.
  • Align those assessment methodologies with principles set forth in FISMA, OMB, and NIST standards and publications, and consider efficient and cost-effective means of assessment to allow senior leaders and stakeholders to make risk-based authorization decisions.
• Planning and Scheduling
  • Develop and maintain a Master Assessment Schedule that tracks new information systems that require full control assessments and existing information systems and common controls under ongoing authorization that are in the continuous monitoring phase of the RMF.
  • Develop the Master Assessment Schedule such that it shall adjust estimated completion dates in real-time to account for unplanned assessments, changes in prioritization, delays, or changes in resource availability. Enable security staff to provide stakeholders with estimated completion dates for all scheduled A&As at any given time.
• Control Tailoring and Overlays
  • Review and update Control Overlays that define and justify the applicable security and privacy controls for information systems with common characteristics, such as internally developed web applications, FedRAMP authorized SaaS solutions, etc.
• Control Assessment Plans
  • Based on the receipt and review of artifacts provided by system owners or support staff that may include, but are not limited to, FIPS-199 Categorization Memos, System Security and Privacy Plans (SSPP), Contingency Plans, etc., develop control assessment plans (CAPs) for each system, service, or common control provider to be assessed, that includes, at minimum:
  • ­The assessment methodology to be followed.

• At least five years of experience performing the functions associated with this labor category.
• Experience performing control assessments as part of a team in accordance with applicable NIST standards (NIST 800-53, Rev 5, or newer version, as applicable).
• Experience preparing control assessment plans, executing technical and non-technical assessments actions, evaluating the risk associated with areas of deficiency, and documenting detailed findings and executive level summaries of assessment results.
• Experience briefing stakeholders on key findings, recommendations, risks, and impacts.
• Experience providing direct support of information security compliance activities, including managing plans of actions and milestones (POA&Ms) and inventories of information systems.
• Certification in one of the following: 

• Certified Information Systems Security Professional (CISSP)
• GIAC Vulnerability Assessor (GEVA)
• Equivalent

About Us:

Edgewater Federal Solutions is a privately held government contracting firm located in Frederick, MD. The company was founded in 2002 with the vision of being highly recognized and admired for supporting customer missions through employee empowerment, exceptional services and timely delivery. Edgewater Federal Solutions is ISO 9001, 20000-1, 270001 certified, appraised at CMMI Level 3 Maturity for Development and Services, and has been named in the Top Workplaces in the Greater Washington Area Small Companies for 2018 through 2025.

It has been and continues to be the policy of Edgewater Federal Solutions to provide equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, gender, sexual orientation, national origin, age, disability, marital status, veteran status, and/or other statuses protected by applicable law. #LI-SW1