Managing Security Consultant - Assessor

Key Responsibilities

• Serve as a Lead Assessor for FedRAMP authorisation and continuous monitoring assessments  
• Lead assessment teams responsible for evaluating cloud service providers against FedRAMP and NIST requirements  
• Conduct independent evaluation of security controls, cloud architectures, operational processes and risk management programmes  
• Review testing methodologies, assessment evidence and assessment reports for accuracy and quality 
• Ensure assessment activities comply with FedRAMP, 3PAO and organisational quality requirements  
• Identify deficiencies, risks and opportunities for improvements and communicate findings clearly to clients and stakeholders 
• Support quality assurance activities and peer reviews across Government Services engagements  

• Provide advisory and readiness services related to:  

• Assist organisations in developing compliance roadmaps and remediation strategies  
• Advise clients on cybersecurity governance, risk management and control implementation  

• Support pre-sales activities, including opportunities qualification, customer briefings, project scoping and proposal development  
• Develop Statements of Work (SOWs), project plans, assumptions and costs. 
• Participate in client workshops and executive-level discussions 
• Act as a trust advisor to customers throughout engagement lifecycles  
• Contribute thought leadership to support the growth of NCC Group’s Government Services practice 

• Support the mentorship and coaching of Junior assessors and consultants  
• Support workforce development and assessment methodology improvements  
• Assist practice leadership with service delivery planning and operational initiatives  
• Promote assessment consistency, quality and professional excellence across engagement teams  

Skills, Knowledge and Expertise

• Demonstrated expertise in information security, cybersecurity consulting, auditing, compliance, risk management, or related disciplines including management of IT organizations.  
• Experience with FedRAMP Assessments and or Advisory Services.  
• Must have extensive experience of auditing and/or assessment experience, 
• Experience leading multi-disciplinary security assessment teams 
• Experience delivering both assurance (assessment) and advisory consulting engagements 
• Experience operating in highly regulated environments requiring exceptional attention to detail and documentation quality 

• U.S. Citizen authorized to work in the United States. 
• Ability to successfully complete required background investigations. 
• Strong understanding of U.S. Government cybersecurity programs and compliance requirements. 
• Experience supporting Federal agencies, defense contractors, cloud service providers, or other government-regulated organizations. 
• Familiarity with government acquisition and cybersecurity compliance environments. 
• Understanding of software supply chain and cloud ecosystem security considerations. 

• Demonstrated experience assessing and securing cloud computing environments across SaaS, PaaS, IaaS, cloud-native, and hybrid architectures 
• Strong understanding of security controls, risk assessment, and remediation within enterprise environments. 

• FedRAMP authorization processes and assessment methodologies. 
• NIST SP 800-53 security controls and control assessment practices. 
• NIST 800-171 and NIST 800-171A 
• Federal cybersecurity compliance programs. 
• Security risk management and risk-based decision making. 
• Security assessment report development and quality review. 
• Executive briefing and stakeholder communications. 

• Experience advising on CMMC requirements and implementation. 
• Experience working with DFARS cybersecurity requirements. 
• Understanding of Federal Executive Orders impacting cybersecurity and software supply chain security. 
• Experience supporting GovRAMP assessments. 
• Familiarity with ISO/IEC 17020 requirements and accreditation standards. 
• Experience supporting accredited conformity assessment organizations or testing laboratories. 

• Certified Information Systems Security Professional (CISSP) 
• Baltimore Cyber Range Technical Proficiency Certification