Security Control Assessor

Job Title: Security Control Assessor 
Locations : 2 days onsite per week Hybrid 

600 Atlantic Ave.
Boston, MA 02210
33 Liberty St.
New York, NY 10045
Ten Independence Mall
Philadelphia, PA 19106
1455 E. Sixth St.
Cleveland, OH 44114
701 E. Byrd St.
Richmond, VA 23219
1000 Peachtree St.
Atlanta, GA 30303
230 S. LaSalle St.
Chicago, IL 60604
411 Locust St.
St. Louis, MO 63102
90 Hennepin Ave.
Minneapolis, MN 55401
1 Memorial Drive
Kansas City, MO 64198
2200 N. Pearl St.
Dallas, TX 75201
101 Market St.
San Francisco, CA 94105

Job Summary
The Security Control Assessor plays a key role in evaluating information systems and security controls to identify risks, vulnerabilities, and compliance gaps. This position conducts security assessments, reviews policies and procedures, and provides recommendations to strengthen the organization’s security posture and support compliance with SAFR requirements and established information security standards. The Security Control Assessor also advises stakeholders on security best practices, risk mitigation, and the implementation of security improvements.

Key Responsibilities

• Conduct comprehensive assessments of information security controls, policies, and procedures to identify risks, vulnerabilities, and compliance gaps.
• Review assessment data and advise stakeholders on SAFR requirements, security best practices, and remediation strategies.
• Evaluate and prioritize security risks and recommend enhancements to improve the security posture of information systems.
• Support the development and implementation of new security processes and their integration with existing processes.
• Assist with communicating policy, process, and security changes to impacted stakeholders and clients.
• Build strong collaborative and consultative relationships with stakeholders, including the ability to negotiate and influence security outcomes.
• Apply risk management principles when evaluating security controls and making recommendations.
• Participate in projects involving the development, implementation, and integration of security processes.
• Perform other related duties as assigned.

• Bachelor’s degree in Computer Science, Information Security, Cybersecurity, or a related field, or equivalent combination of education and experience.
• 3–5+ years of relevant information security, cybersecurity, compliance, or security assessment experience.
• Proven experience conducting security assessments and evaluating security controls.
• Knowledge of security compliance frameworks and continuous authorization processes, preferably including NIST SP 800-37 and NIST SP 800-53/53A.
• Experience reviewing security data and advising stakeholders on compliance requirements and security best practices.
• Understanding of risk management principles and their application to security decision-making.
• Excellent written and verbal communication skills with the ability to collaborate effectively across technical and business teams.
• Strong interpersonal, analytical, problem-solving, and negotiation skills.
• Strong attention to detail and the ability to evaluate complex information and develop practical recommendations.
• Ability to build effective working relationships and communicate security requirements to a variety of stakeholders.

• Professional certification such as CISSP, CISA, or CISM.
• Experience working in a policy, security assurance, regulatory, or quasi-governmental environment.
• Familiarity with cloud service providers and associated cloud security challenges.
• Knowledge of SAFR lifecycle compliance, assessment, and testing.
• Experience supporting the implementation of security policies, processes, and controls across complex organizations.
• Experience advising customers or stakeholders on security compliance requirements and best practices.
• Familiarity with continuous monitoring, authorization, and risk management processes.