Senior Security Control Assessor (FedRAMP 3PAO) - US Remote

Insight Assurance is a global audit firm on a mission to transform how organizations achieve cybersecurity and compliance. Founded by former Big 4 (EY) professionals, we deliver next-generation audit services across SOC 2, ISO 27001, PCI DSS (QSA), HITRUST, CMMC (C3PAO), and FedRAMP (3PAO) frameworks.

We’re not your traditional audit firm — we’re tech-enabled, leveraging compliance automation and advanced collaboration tools to make audits faster, smarter, and more impactful for our clients.

Recognized on the Inc. 5000 and Fast 50 lists, Insight Assurance is one of the fastest-growing global audit firms, with 230+ professionals supporting nearly 2,500 clients across the Americas, EMEA, and APAC.

Position Summary

The Senior Security Control Assessor leads FedRAMP assessments within Insight Assurance’s A2LA-accredited FedRAMP 3PAO practice. This role is accountable for the quality of the deliverables on assigned engagements, signs off on the assessment work the team performs, and mentors Junior and Mid-Level Assessors. You will evaluate security controls in cloud systems against FedRAMP and NIST requirements across Rev5 and FedRAMP 20x, and will also work on GovRAMP and other federal assessments.

This is an independent assessment role. It does not include consulting, remediation design or sales support. The team does not perform CMMC work.

• Active Certified Information Systems Security Professional (CISSP).
• At least one additional active certification from the A2LA-approved list below: CASP+ CE; GCED; GCIH; GSLC; CISA; CISM; CCSP; CISSP-ISSAP; CISSP-ISSEP; CISSP-ISSMP; CFR; CCISO. If you hold only the CISSP, completing the BCR Cyber activity after hire also satisfies this requirement.

Preferred

• Other relevant security certifications, for example CGRC, ISO 27001 Lead Auditor, or an AWS, Azure or Google cloud security or architect certification. Insight Assurance reviews other certifications for relevance.

EXPERIENCE

• Minimum five years of auditing and/or assessment experience in security compliance frameworks.
• Experience leading assessment engagements or mentoring assessors.
• Prior experience with FedRAMP, FISMA or NIST SP 800-53 assessments is strongly preferred.
• Prior 3PAO, GovRAMP, TX-RAMP or FedRAMP 20x experience is preferred.

DUTIES AND RESPONSIBILITIES

Engagement Delivery

• Lead assessments from planning through reporting: the SAP, SAR and RET for Rev5, KSI-based reporting for FedRAMP 20x, and GovRAMP RAR, SR-SAP and SR-SAR.
• For FedRAMP 20x, test both the security capability and the measurement system behind each Key Security Indicator, including code review, API testing and cloud architecture analysis. Check that automated evidence runs at the stated cadence, covers the full scope and is reproducible.
• Review and validate findings against the FedRAMP Criteria for Document Acceptance, and include the required authorization recommendation in each SAR.
• Sign off on the assessments assigned to you. Escalate any doubt about quality, evidence or independence to the Technical Manager.
• Serve as the primary contact for assessment communications with the client. Record disagreements and keep your assessment record separate from the provider’s.

Team Leadership

• Lead the assessment team with the Project Manager and keep staffing within A2LA minimums (Senior Assessor, Penetration Tester and Junior Assessor).
• Mentor, supervise and evaluate Junior and Mid-Level Assessors, and help deliver internal training.

Quality and Independence

• File the After Action Report within 30 days of engagement end, support A2LA witnessing, surveillance and for-cause assessments, and report any conflict of interest right away.
• Do not design, select or implement a client’s remediation, and do not provide advisory services or sales support to any client you assess. Findings carry the FedRAMP-required recommendation only.
• Do not assess a client that Insight Assurance advises or has advised, and disclose any prior relationship with a CSP you may be assigned to.

SKILLS

Technical Skills

• Deep knowledge of NIST SP 800-53 Rev5 and 800-53A, FedRAMP baselines and cloud security.
• Working knowledge of cloud-native architecture (AWS, Azure, GCP), Infrastructure-as-Code such as Terraform, CI/CD pipelines and API-based evidence collection.
• Ability to read scripts, queries and IaC well enough to test automated validation.

Professional Skills

• Strong leadership, written and verbal communication, and analytical skills.
• Ability to assess complex cloud systems and to hold an independent position under client pressure.

EDUCATION

Required

Bachelor’s degree in Information Technology, Cybersecurity or a closely related field, or equivalent experience.

Preferred

Master’s degree in Information Technology, Cybersecurity or a related discipline.

• Flexible Paid Time Off and paid Holidays
• 100% Remote
• Competitive salary and benefits package.
• Opportunities for professional growth and development.
• Collaborative and innovative work environment.
• Paid BCR Cyber exam and paid annual training.
• A defined career path to Senior Manager, Federal Assessments.

Insight Assurance is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.

Privacy Notice CCPA

• Insight Assurance shares your personal data/information with Greenhouse recruiting because this is the tool we use for the recruitment process.
• Insight Assurance does not sell personal data/information under any circumstances.
• You may exercise your rights under personal data protection legislation by reaching out to us via: HR@insightassurance.com or submit a request via mail at 400 N Tampa St. 15th Floor Suite 122, Tampa, FL 33602

Privacy Notice GDPR:

This notice informs you about the categories of Personal Data/ Information and the Purpose and Scope of Processing Activities to be undertaken by Insight Assurance (we, us, our), under its job application and recruitment process.

We resort to Greenhouse.com as the platform that supports our recruitment process, and therefore your Personal Data/ Information will be Processed on this tool (hosted, shared with, cross-referenced, accessed by our team); we have in place contractual terms and the commitment of Greenhouse.com that ensures the Security and Confidentiality plus Purpose limitation with regards to the Processing of your Personal Data.

When you reply to one of your job postings, you voluntarily and freely submit your Personal Data to us; this, allied with the fact that the Processing by us (and over Greenhouse.com) of that Personal Data has the sole Purpose of validating your application and proceeding with the inherent scrutiny and decision, allows us to argue having Legitimate Interest as the applicable Legal Basis to undertake the Processing of your Personal Data under this scope.

We are a U.S. based company, hence some or all Personal Data pertaining to you will be hosted in the U.S.

The categories of Personal Data under Processing consist of:

• Identification
• Contact
• Education and Professional
• Interview performance
• Evaluation

You may exercise several Rights as determined under applicable Personal Data Protection legislation, in short:

• Right of Access – meaning getting information about the Personal Data under Processing by us, except for the information you already know;
• Right of Erasure – you may ask for us to erase all Personal Data pertaining to you under Processing; this may imply you being excluded from the recruitment process, for without information we cannot proceed with it;
• Right of Opposition or Restriction of Processing – you may ask us to stop some Processing or restrict the Processing of some Personal Data, this may imply you being excluded from the recruitment process, at our sole discretion also for without information we cannot proceed with it;
• Rectification – you can rectify your Personal Data at anytime