Jobs › Massachusetts › Boston › Security Control Assessor
Security Control Assessor
National Institute of Standards and Technology is hiring for the job of Security Control Assessor, Gaithersburg, Maryland (On-site). This is a Cybersecurity job in the governance, risk, and compliance field, with a posted range of $121785 - $187093 Per Year. Review the full details below and apply directly with National Institute of Standards and Technology.
The Office of Information Systems Management, IT Security and Networking Division, is seeking a Security Control Assessor to lead robust Assessment and Authorization (A&A) activities, ensure Federal Information Security Management Action (FISMA) compliance, and act as a vital line of defense in mitigating IT security risks across the agency. This notice is issued under direct-hire authority to recruit new talent to occupations for which NIST has a severe shortage of candidates.
Qualifications: Selective Placement Factor: Applicants must possess a current/active IT Security Certification (e.g., CISSP, GIA, SSCP, CEH, GCIH, CISA, CGRC). A current/active copy of your certification must be provided in your application package. Specialized Experience: In addition to meeting the selective placement factor, applicants must have one year (52 weeks) of specialized experience equivalent to at least the GS-12 level (ZP-III at NIST). Specialized experience is defined as: Conducting detailed security assessments against Special Publication 800-53 Revision 5 security controls Developing security authorization documents (i.e., Systems Security Plans, Risk Assessments, Security Categorization, Privacy Impact Assessment, Test and Evaluation, and Contingency Plans) Reviewing security authorization packages Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience. The qualification requirements in this vacancy announcement are based on the U.S. Office of Personnel Management (OPM) Qualification Standards Handbook. If requesting reconsideration of your qualification determination, please refer to the following site: Applicant Reconsideration
Certifications this role asks for
Studying for one of these? Try the free CISA practice questions in our academy. No signup, no cost.
Location and market context
This job is based in Gaithersburg on-site. Local candidates benefit from being close to National Institute of Standards and Technology's teams and regional hiring market. Confirm the exact in-office expectation and any relocation support with the employer.
About cybersecurity governance jobs
Cybersecurity governance connects security control frameworks to business and regulatory risk, covering policy, risk assessment, and control assurance rather than hands-on operations. Jobs like this one are typically evaluated against frameworks such as NIST CSF, ISO/IEC 27001, SOC 2, and security risk and control-assurance practices.
How to position yourself for this cybersecurity governance job
Strong candidates emphasize security control frameworks, risk assessment, policy and standards, and translating technical security posture into governance and board-level reporting. In your resume and outreach, tie your experience to how National Institute of Standards and Technology would apply NIST CSF, ISO/IEC 27001, SOC 2, and security risk and control-assurance practices, and lead with concrete outcomes rather than duties.
Similar GRC jobs
- IT Cyber Security Specialist (DIRECT HIRE) · Transportation Security Administration · Annapolis Junction, Maryland
- IT CYBERSECURITY SPECIALIST (SYSADMIN) · U.S. Marine Corps · Fort Meade, Maryland
- IT CYBERSECURITY SPECIALIST (INFOSEC) · U.S. Marine Corps · Fort Meade, Maryland
- Supervisory Information Technology Cybersecurity Specialist · Joint Activities · Fort Meade, Maryland
- IT CYBERSECURITY SPECIALIST (PLCYPLN/INFOSEC) · Defense Information Systems Agency · Fort Meade, Maryland
- Cyber Assessments Officer · Joint Activities · Columbia, Maryland
- Cyber Exercise Planner · Joint Activities · Fort Meade, Maryland
- Information Technology Cybersecurity Specialist · U.S. Coast Guard · Glen Burnie, Maryland
More GRC jobs in Gaithersburg
- Supervisory Security Specialist (Insider Threat) · Defense Information Systems Agency · Fort Meade, Maryland
- Senior Technical Advisor for Risk Assessment and Analysis · Nuclear Regulatory Commission · Rockville, Maryland
- QUALITY ASSURANCE SPECIALIST (AIRCRAFT) · Air Force District of Washington · Andrews AFB, Maryland
- CYBER WORKFORCE DEVELOPMENT ANALYST · Joint Activities · Fort Meade, Maryland
- IT Cybersecurity Specialist (PLCYPLN) - CES Recent Graduate · Defense Information Systems Agency · Fort Meade, Maryland
- Lead, Governance, Risk & Compliance (Remote) · Emergent BioSolutions · Gaithersburg, MD
Hiring for Cybersecurity?
Reach candidates who are already searching for this role, not a general audience. Your posting appears on this page, in the job alerts, and across the GRC Careers network.
Post a job Pricing from $99 · About GRC Careers · Hiring toolkit
Want to be next in a job like this?
Jobs like Security Control Assessor in Gaithersburg, Maryland open regularly. Be first to know, privately. No current employer ever sees you looking.
Employer, or see something wrong with this posting? Report this posting and we will review it promptly.