Security Assessment & Authorization (SA&A) Lead

Description

* This position is contingent upon a future opening with Gunnison.

Salary: $130,000 - $145,000/year

Work location: Hybrid, 2-3 days per week on-site in Bethesda, MD.

• Lead Security Assessment and Authorization (SA&A) activities for NIH CIT enterprise information systems, including on-premises, cloud-based, network, hosting, endpoint, and shared-service environments.
• Plan, develop, coordinate, review, and maintain Authorization to Operate (ATO) packages in accordance with the NIST Risk Management Framework (RMF), NIST SP 800-37, NIST SP 800-53, FISMA, and applicable HHS, NIH, and federal security requirements.
• Lead development and maintenance of system authorization artifacts, including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), risk assessments, contingency plans, incident response plans, and associated supporting documentation.
• Write, review, assess, and validate security-control implementation statements against applicable NIST SP 800-53 controls and control enhancements.
• Conduct security-control assessments, including evidence review, technical validation, stakeholder interviews, and assessment testing; document findings, assess risks, and recommend corrective actions.
• Create, maintain, track, and update Plans of Action and Milestones (POA&Ms), ensuring findings have clear owners, remediation milestones, risk ratings, status updates, and closure evidence.
• Prepare Risk Assessment Memoranda and other risk-based decision packages that clearly describe security risks, proposed mitigations, residual risk, and recommended courses of action for management review.
• Develop and maintain system and program-level risk registers; identify and communicate high-risk conditions, trends, overdue remediation actions, dependencies, and emerging compliance concerns to program and Government leadership.
• Coordinate and facilitate incident response (IR) and contingency planning (CP) tests, tabletop exercises, and after-action activities; document results, corrective actions, lessons learned, and required updates to security documentation.
• Review ATO packages for completeness, accuracy, consistency, and readiness before submission to the CISO, CIO, Authorizing Official, or designated approval authority.
• Conduct assessment entrance and exit meetings with system owners, system administrators, ISSOs, engineers, and other stakeholders; debrief teams on assessment findings, remediation expectations, and next steps.
• Advise system owners and technical teams on RMF implementation, security-control compliance, risk acceptance, remediation planning, and authorization strategy.
• Prepare clear, timely assessment reports, compliance dashboards, executive briefings, status reports, and decision memoranda for technical and leadership audiences.
• Lead and mentor SA&A analysts and assessors; assign and review work, maintain quality standards, and coordinate simultaneous authorization and continuous-monitoring activities across multiple systems.

Requirements

Minimum of three (3) to five (5) years of progressively responsible experience in security assessment and authorization, RMF, information-system security, cybersecurity compliance, or a related discipline.

Candidates must demonstrate experience in:

• Developing, updating, and submitting ATO packages for enterprise systems, including cloud-hosted or hybrid environments.
• Applying the NIST RMF lifecycle under NIST SP 800-37.
• Assessing and documenting implementation of NIST SP 800-53 security controls and control enhancements.
• Creating and maintaining SSPs, SARs, SAPs, POA&Ms, risk assessments, risk registers, and other authorization artifacts.
• Planning and conducting security-control assessments, evidence reviews, stakeholder interviews, technical validations, and remediation verification.
• Facilitating IR and CP tests or tabletop exercises and documenting outcomes and corrective actions.
• Preparing risk-based decision packages, including risk assessment memoranda and risk acceptance/mitigation recommendations.
• Reviewing authorization packages before senior leadership submission and briefing assessment findings to system owners and management.
• Supporting continuous-monitoring, vulnerability-management, configuration-management, and compliance-reporting processes.
• Bachelor’s degree from an accredited college or university in cybersecurity, information assurance, information systems, computer science, computer engineering, network engineering, systems engineering, or a closely related technical discipline. 
• Certified Information Systems Security Professional (CISSP), current and active
• Certified Authorization Professional (CAP), current and active

Clearance Requirement: Ability to obtain and maintain a Public Trust.

Desired Qualifications:

• Master’s degree in cybersecurity, information assurance, information systems, computer science, engineering, public administration, business administration, or a related discipline.  
• Certified Information Security Manager (CISM)
• Certified Information Systems Auditor (CISA)
• Certified Cloud Security Professional (CCSP)
• CompTIA Security+, CySA+, CASP+, or equivalent
• Project Management Professional (PMP)
• ITIL Foundation
• AWS Certified Security – Specialty
• Microsoft Certified: Azure Security Engineer Associate
• Google Professional Cloud Security Engineer
• GIAC certifications relevant to governance, incident response, audit, cloud security, or risk management
• Federal RMF, FISMA, NIST, cloud-security, or security-assessment training
• Certified in Risk and Information Systems Control (CRISC)
• ISO/IEC 27001 Lead Implementer or Lead Auditor

The salary range for this position depends upon multiple factors including location, the individual's knowledge, skills, competencies, and experience, and contract-specific budget constraints and organizational requirements.
Gunnison Consulting Group's total compensation package also includes bonus and profit-sharing opportunities, depending on company and employee performance. Available employee benefits include:

• 3 weeks of Personal Leave your first year
• 11 paid Holidays each year
• 5 days of Flexible Time Off each year for approved training or certifications (self-study is ineligible)
• 401(k) company match at 50% up to 10% of your salary
• Medical, Dental and Vision Insurance
• Life and Disability Insurance
• Public Transportation Subsidies
• Certifications and Training Allowance - Up to $5,000/year!

Why Join Gunnison?

• Gunnison takes on ambitious projects. We target fun, challenging work that requires creative thinking and innovation.
• Quality is our top priority.
• Gunnison employee benefits meet or exceed what other companies in the Washington, D.C. metropolitan area offer.
• There is a great sense of camaraderie at Gunnison. This is an atmosphere we will maintain as we continue to grow.
• We are growing rapidly and the opportunity for individual professional growth with Gunnison is outstanding.
• We hire for careers at Gunnison, not to fill a position.

Equal Opportunity/Affirmative Action Employer. Must be eligible for employment in the United States. We are unable to sponsor candidates at this time.
In 1994 Gunnison began serving the greater Washington, D.C. metro area, focused on tackling our customers' most ambitious technology projects. By creating a culture dedicated to enabling our customers and employees to achieve more than they ever thought they could, the company has thrived for over 25 years.