A bachelor's degree in a related area of study, such as Security or Information Technology.
Zero to one year of experience is required; the employer is willing to train on the technologies and RMF.
An active DoD Top Secret clearance is required; candidates with a Secret clearance may begin, and SCI eligibility is preferred.
An active IAT Level II certification is required or must be obtained within 90 days of hire; accepted certifications listed are CompTIA Cybersecurity Analyst (CySA+), CompTIA Security+, EC-Council Certified Network Defense (CND) v3, Red Hat Certified System Administrator (RHCSA), CCNA Security, Global Industrial Cyber Security Professional (GICSP), GIAC Security Essentials (GSEC), or Systems Security Certified Practitioner (SSCP).
The candidate must be certified via the ACP in accordance with the ACP CONOPS before conducting assessments.
The candidate must be certified in at least two technologies and RMF Control Validation before conducting assessments; training through the DISA program will be provided after hire and will last at least three months.
The contractor must maintain active accounts to the tools and systems required to perform risk assessments.
Strong written and verbal communication skills are required for reporting assessment findings.
Responsibilities
Conduct cybersecurity assessments, audits, and inspections for DoD organizations and partners handling DoD information or connecting to the DoDIN.
Evaluate systems and Defensive Cyberspace Operations using cyber threat emulation and performance-based testing.
Follow the policies and processes applicable to each assessment type.
Support assessment development and execution to ensure security expertise is properly applied.
Coordinate logistics, test plans, and scope with the SCA Team Lead.
Perform vulnerability assessments, capture results using STIG Viewer or designated tools, and document findings in eMASS.
Analyze security gaps and provide mitigation recommendations.
Validate cybersecurity controls, TTPs, STIGs, RMF controls, and compliance with DoD policies and guidelines.
Provide risk analysis and assessment results for authorization recommendations.
Participate in daily assessment reviews, in-briefs, and out-briefs, sharing findings with the SCA-R.
For each RMF review, review applicable controls to determine compliance status and enter all test results into the designated repository, eMASS.
Provide key assessment results to the team lead, including the number of controls reviewed and risk and residual information for inclusion in the authorization recommendation.
Participate in the in-brief and out-brief of each assessment.
Desired Qualifications
Familiarity with STIGs (Security Technical Implementation Guides), Security Requirement Guides (SRGs), Plans of Action and Milestones (POA&Ms), and cybersecurity best practices.
Understanding of the RMF process, NIST SP 800-37, NIST SP 800-53, and CNSSI 1253.
Familiarity with relevant tools such as eMASS, STIG Viewer, Nessus, ACAS, SCAP, or HBSS.
Job Summary Newberry Group seeks a Jr. Security Control Assessor to support its Government Client. This role requires 85% travel to various government locations both domestically and internationally. Location Hybrid position – approx. 25% remote support with up to 75% CONUS and OCONUS travel.
Clearance Active DoD Top Secret Clearance required.
Certifications DoD 8570 IAT II (active or will obtain within 90 days of hire)
Contingencies If an opening is not currently available, candidates applying to this role will be placed in our pipeline for future openings within this contract's program.
Compensation $50,000 - $70,000
Primary Responsibilities:
Conduct cybersecurity assessments, audits, and inspections for DoD organizations and partners handling DoD information or connecting to the DoDIN.
Evaluate systems and Defensive Cyberspace Operations using cyber threat emulation and performance-based testing.
Adhere to policies and processes for each assessment type.
Support assessment development and execution to ensure security expertise is properly applied.
Coordinate logistics, test plans, and scope with the SCA Team Lead.
Perform vulnerability assessments, capture results using STIG Viewer or designated tools, and document findings in eMASS.
Analyze security gaps and provide mitigation recommendations.
Validate cybersecurity controls, TTPs, STIGs, RMF controls, and compliance with DoD policies and guidelines.
Provide risk analysis and assessment results for authorization recommendations.
Participate in daily assessment reviews, in-briefs, and out-briefs, sharing findings with the SCA-R.
For each RMF Review, the assessors shall perform the following:
The candidate will be required to review applicable controls to determine compliance status and enter all test results into the designated repository (Enterprise Mission Assurance Support Service (eMASS)
Providing key assessment results to the team lead to include the number of controls reviewed and risk/residual information for inclusion in the authorization recommendation.
The candidate will be required to be certified via the ACP IAW the ACP CONOPS before conducting any assessments.
The candidate must be certified in a minimum of two (2) technologies and RMF Control Validation before conducting any assessments. Training through the DISA program will be provided after hire and consist of at least 3 months.
The contractor shall maintain active accounts to the tools and systems required to perform risk assessments.
The candidate will be required to participate in the in-brief and out-brief of each assessment.
Qualifications:
Bachelor's degree in a related area of study (i.e. Security, Information Technology).
0-1 year of experience required. Willing to train on both technologies and RMF.
Active DoD Top Secret clearance with SCI eligibility is preferred but can begin with a secret clearance.
IAT Level II certification active or will obtain within 90 days of hire.
CompTIA Cybersecurity Analyst (CySA+)
CompTIA Security.
EC-Council Certified Network Defense (CND) v3.
Red Hat Certified System Administrator (RHCSA)
CCNA Security.
Global Industrial Cyber Security Professional (GICSP)
GIAC Security Essentials (GSEC)
Systems Security Certified Practitioner (SSCP)
Familiarity with STIGs (Security Technical Implementation Guides), Security Requirement Guides (SRGs), Plan of Action and Milestones (POA&Ms) and cybersecurity best practices desired.
Understanding of the RMF process, NIST SP 800- 37, NIST SP 800-53, CNSSI 1253 desired
Familiarity with relevant tools such as eMASS, STIG Viewer, Nessus, ACAS, SCAP, or HBSS desired
Strong written and verbal communication skills for reporting assessment findings.
Who We Are… Today’s leading government agencies are putting their trust in Newberry Group, and for good reason. Newberry brings strength to our clients, from the inside out, through: • client intimacy and superior quality, • presence and accountability in our relationships, and • Public sector best practices. Newberry Group is a professional services firm, providing information security compliance, governance, program/project management, and mission-critical project-based consulting to public sector clients nationwide. The strength of our company is a direct reflection of our highly skilled and talented workforce.
Benefits and Perks In addition to competitive wages, Newberry Group offers an outstanding benefit package. This includes medical coverage with three plan options, dental and vision coverage, personal time off, paid holidays, paid parental leave, telecommuting if available, retirement savings accounts (Pre-Tax and Roth), flexible and dependent care savings accounts, life insurance, long and short-term disability coverage, tuition and training reimbursement, employee assistance program, and more. The Newberry Group, Inc. is an Equal Opportunity Employer – EEO/AA/Disability/Veterans.