Control Assessment Senior in Washington, District of Columbia at Crest Security Assurance

Position Overview

Crest Security Assurance (Crest) is seeking a Control Assessment Senior to provide Federal Information Security Modernization Act (FISMA) and Risk Management Framework (RMF) support for federal cloud-based applications and information systems hosted in Microsoft Azure, Amazon Web Services (AWS), and Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS) environments. The position will support cloud security assessments, guide cloud systems through the Authorization to Operate (ATO) process, manage Plans of Action and Milestones (POA&Ms), evaluate cloud security configurations and controls, and support continuous monitoring and ongoing authorization activities.

The analyst will work alongside existing security analysts and collaborate with system owners, cloud architects, developers, cloud service providers (CSPs), technical teams, and vendors to assess cloud security controls, evaluate cybersecurity risks, document compliance findings, and maintain security and privacy compliance throughout the system lifecycle. The position requires an understanding of federal cloud security requirements, FedRAMP, cloud shared responsibility models, and security control inheritance across commercial and government cloud environments.

Key Responsibilities

• Provide FISMA and NIST RMF support for federal cloud applications and systems hosted in Microsoft Azure, Azure Government, AWS, AWS GovCloud, and SaaS, PaaS, and IaaS environments, from initial authorization preparation through continuous monitoring and ongoing authorization.
• Support cloud-hosted systems through the ATO process by coordinating security assessments, preparing and reviewing authorization documentation, evaluating cloud-specific security requirements, tracking approval activities, and resolving security control implementation and evidence gaps.
• Prepare, review, and maintain authorization artifacts, including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), control implementation narratives, cloud architecture and system boundary documentation, and supporting security assessment evidence.
• Plan and execute technical and nontechnical security control assessments using NIST SP 800-53 Rev. 5 or the applicable newer version and NIST SP 800-53A, evaluating control effectiveness across cloud infrastructure, applications, platforms, and externally hosted services.
• Assess cloud security controls covering identity and access management (IAM), multifactor authentication (MFA), privileged access, encryption, key management, network security, logging and monitoring, vulnerability management, configuration management, data protection, and incident response.
• Evaluate cloud service providers and SaaS/PaaS solutions for compliance with applicable FedRAMP, FISMA, NIST, and agency-specific security requirements, including reviewing FedRAMP authorization packages, inherited security controls, customer-responsible controls, and shared responsibility obligations.
• Review and assess cloud-native security configurations, monitoring capabilities, and supporting evidence from services such as Microsoft Entra ID, Microsoft Defender for Cloud, Azure Policy, Azure Monitor, AWS CloudTrail, AWS Config, and AWS Security Hub, as applicable to the assessed environment.
• Manage POA&Ms by documenting security weaknesses, evaluating cloud-related vulnerabilities and misconfigurations, coordinating corrective actions with system owners and cloud engineering teams, tracking remediation milestones, and validating evidence supporting closure.
• Support continuous monitoring of cloud systems through recurring security control assessments, vulnerability and configuration reviews, security event analysis, change impact assessments, and compliance status reporting.
• Assess security implications associated with cloud migrations, new SaaS/PaaS integrations, cloud infrastructure changes, application deployments, and changes to system authorization boundaries, identifying potential impacts to existing ATOs and security control implementations.
• Help develop and improve cloud security assessment and authorization processes, including standardized assessment procedures, cloud-specific control testing methods, evidence collection techniques, reporting metrics, and compliance documentation.

Additional Responsibilities

• Assess cybersecurity and data privacy risks associated with cloud infrastructure, applications, third-party SaaS solutions, and externally managed platforms; prepare detailed findings, executive summaries, and risk recommendations for technical and executive stakeholders.
• Support cloud vendor risk management activities, including the evaluation of cloud service provider security documentation, FedRAMP authorization status, third-party assessments, service-level agreements, and compliance responsibilities.
• Collaborate with cloud architects, system administrators, developers, application owners, and vendors to identify security gaps, validate remediation actions, and ensure security requirements are integrated into cloud service operations.
• Maintain information system inventories, including cloud-hosted applications, SaaS subscriptions, cloud service dependencies, authorization boundaries, and associated security and privacy assets.
• Support security reporting and dashboard development to communicate cloud compliance posture, control assessment results, outstanding POA&Ms, vulnerability trends, and ongoing authorization status.
• Develop metrics and reports on the effectiveness of security, privacy, and social engineering training and awareness activities.

Required Qualifications

• At least five years of experience performing security control assessments, federal security compliance, assessment and authorization, or closely related cybersecurity functions.
• Demonstrated experience providing FISMA and RMF support for cloud-based applications and information systems, including systems deployed in Microsoft Azure, AWS, or comparable federal cloud environments.
• Experience assessing SaaS, PaaS, and IaaS cloud service models, including understanding cloud security architectures, customer-managed versus provider-managed security responsibilities, and inherited security controls.
• Demonstrated experience supporting cloud systems through the federal ATO process, including authorization documentation, security control assessments, compliance evidence collection, stakeholder coordination, and approval workflows.
• Experience managing POA&Ms and performing continuous monitoring for federal information systems, including cloud-related security weaknesses, vulnerabilities, configuration deficiencies, and remediation validation.
• Experience conducting technical and nontechnical security control assessments as part of a team, including assessment planning, control testing, cloud security evidence review, risk evaluation, and documentation of findings.
• Strong knowledge of NIST RMF, NIST SP 800-37, NIST SP 800-53 Rev. 5 or newer as applicable, NIST SP 800-53A, NIST SP 800-171, FedRAMP requirements, relevant OMB memoranda, and applicable federal cloud security policies.
• Understanding of cloud security concepts, including IAM, role-based access control (RBAC), network segmentation, encryption, cloud logging, vulnerability management, cloud configuration baselines, zero trust principles, and cloud data protection requirements.
• Familiarity with cloud-native security and compliance tools such as Microsoft Defender for Cloud, Microsoft Entra ID, Azure Policy, AWS Security Hub, AWS Config, AWS CloudTrail, or equivalent cloud security monitoring and assessment platforms.
• Experience developing and implementing compliance programs, conducting cybersecurity and privacy risk assessments, and advising system owners and technical stakeholders on cloud security risks and remediation strategies.
• Experience maintaining information system inventories, evaluating vendor security documentation, and supporting federal security compliance activities.
• Ability to explain complex federal cybersecurity, cloud security, and regulatory requirements clearly and brief technical stakeholders and senior leadership on assessment findings, risks, and recommendations.
• Basic understanding of federal procurement processes and contract language related to federal cybersecurity and cloud security mandates.
• Experience tracking training and awareness performance and developing metrics for security, privacy, and social engineering training.
• U.S. citizenship and ability to work 100% onsite in Washington, DC, five days per week.

Preferred Qualifications

• Experience performing security control assessments or supporting ATO activities for applications hosted in Azure Government, AWS GovCloud, or FedRAMP-authorized SaaS/PaaS environments.
• Experience reviewing FedRAMP authorization packages, including SSPs, SARs, POA&Ms, control inheritance documentation, and customer responsibility matrices.
• Experience with federal security compliance and GRC platforms such as CSAM, Xacta, eMASS, or ServiceNow GRC.
• Familiarity with hybrid cloud environments, cloud migration security assessments, containerized applications, serverless computing, or modern cloud application architectures.
• Relevant certifications such as CISSP, CISA, CAP/CGRC, CCSP, AWS Certified Security – Specialty, or Microsoft Certified: Azure Security Engineer Associate.