What are the responsibilities and job description for the Security Control Assessor position at National Institute of Standards and Technology (NIST)?
Summary
The Office of Information Systems Management, IT Security and Networking Division, is seeking a Security Control Assessor to lead robust Assessment and Authorization (A&A) activities, ensure Federal Information Security Management Action (FISMA) compliance, and act as a vital line of defense in mitigating IT security risks across the agency. This notice is issued under direct-hire authority to recruit new talent to occupations for which NIST has a severe shortage of candidates.
Duties
Working as a Security Control Assessor in the Office of Information Systems Management, IT Security and Networking Division, you will perform the following duties: Conduct Assessment & Authorization (A&A) activities on NIST systems in accordance with Federal Information Security Management (FISMA) requirements. This includes conducting security documentation reviews to ensure control implementation is described appropriately, conducting security assessments to verify control implementation against the security controls required for a given system impact level, conducting secure configuration assessments, and documenting the risks and plans of action & milestones for mitigating IT security risks identified within the system.
Qualifications
Selective Placement Factor: Applicants must possess a current/active IT Security Certification (e.g., CISSP, GIA, SSCP, CEH, GCIH, CISA, CGRC). A current/active copy of your certification must be provided in your application package. Specialized Experience: In addition to meeting the selective placement factor, applicants must have one year (52 weeks) of specialized experience equivalent to at least the GS-12 level (ZP-III at NIST). Specialized experience is defined as: Conducting detailed security assessments against Special Publication 800-53 Revision 5 security controls Developing security authorization documents (i.e., Systems Security Plans, Risk Assessments, Security Categorization, Privacy Impact Assessment, Test and Evaluation, and Contingency Plans) Reviewing security authorization packages Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience. The qualification requirements in this vacancy announcement are based on the U.S. Office of Personnel Management (OPM) Qualification Standards Handbook. If requesting reconsideration of your qualification determination, please refer to the following site: Applicant Reconsideration
The Office of Information Systems Management, IT Security and Networking Division, is seeking a Security Control Assessor to lead robust Assessment and Authorization (A&A) activities, ensure Federal Information Security Management Action (FISMA) compliance, and act as a vital line of defense in mitigating IT security risks across the agency. This notice is issued under direct-hire authority to recruit new talent to occupations for which NIST has a severe shortage of candidates.
Duties
Working as a Security Control Assessor in the Office of Information Systems Management, IT Security and Networking Division, you will perform the following duties: Conduct Assessment & Authorization (A&A) activities on NIST systems in accordance with Federal Information Security Management (FISMA) requirements. This includes conducting security documentation reviews to ensure control implementation is described appropriately, conducting security assessments to verify control implementation against the security controls required for a given system impact level, conducting secure configuration assessments, and documenting the risks and plans of action & milestones for mitigating IT security risks identified within the system.
Qualifications
Selective Placement Factor: Applicants must possess a current/active IT Security Certification (e.g., CISSP, GIA, SSCP, CEH, GCIH, CISA, CGRC). A current/active copy of your certification must be provided in your application package. Specialized Experience: In addition to meeting the selective placement factor, applicants must have one year (52 weeks) of specialized experience equivalent to at least the GS-12 level (ZP-III at NIST). Specialized experience is defined as: Conducting detailed security assessments against Special Publication 800-53 Revision 5 security controls Developing security authorization documents (i.e., Systems Security Plans, Risk Assessments, Security Categorization, Privacy Impact Assessment, Test and Evaluation, and Contingency Plans) Reviewing security authorization packages Experience refers to paid and unpaid experience, including volunteer work done through National Service programs (e.g., Peace Corps, AmeriCorps) and other organizations (e.g., professional; philanthropic; religious; spiritual; community, student, social). Volunteer work helps build critical competencies, knowledge, and skills and can provide valuable training and experience that translates directly to paid employment. You will receive credit for all qualifying experience, including volunteer experience. The qualification requirements in this vacancy announcement are based on the U.S. Office of Personnel Management (OPM) Qualification Standards Handbook. If requesting reconsideration of your qualification determination, please refer to the following site: Applicant Reconsideration