ENDICTUS is seeking an experienced Federal Privacy Assessor to lead an independent assessment of a federal agency privacy program. The selected professional will evaluate the effectiveness and maturity of privacy policies, procedures, controls, documentation, and operational practices, with particular emphasis on NIST SP 800-53 Revision 5 privacy controls.

The Privacy Assessor will review Privacy Impact Assessments (PIAs), Systems of Records Notices (SORNs), Privacy Act Statements, data inventories, policies, procedures, and supporting control evidence; assess implementation and effectiveness of applicable privacy controls; identify privacy risks and control deficiencies; develop actionable remediation recommendations; and prepare assessment documentation and executive-level findings.

This position requires substantive hands-on federal privacy assessment experience. General cybersecurity, RMF, or security-control experience alone is not sufficient unless it includes direct privacy-control assessment responsibilities.

 This is a fully remote position. Candidates can work from anywhere in the United States. However, preference will be given to applicants residing in the Washington, D.C. metropolitan area. 

Key Responsibilities

Privacy Program Assessment

• Plan and execute an independent assessment of a federal agency privacy program.
• Develop and maintain an assessment plan defining scope, methodology, schedule, assessment activities, evidence requirements, and stakeholder engagement.
• Evaluate the design, implementation, and effectiveness of applicable privacy controls.
• Review the agency's privacy governance structure, policies, procedures, standards, and supporting artifacts.
• Assess whether documented privacy practices align with applicable federal requirements and agency procedures.
• Identify gaps, weaknesses, inconsistencies, and areas of privacy risk.
• Maintain objective, evidence-based traceability between assessment criteria, supporting evidence, findings, risk ratings, and recommendations.

NIST SP 800-53 Rev. 5 Privacy Control Assessment

• Assess applicable NIST SP 800-53 Rev. 5 privacy controls.
• Review evidence demonstrating control implementation and effectiveness.
• Map agency privacy documentation and practices to applicable NIST SP 800-53 Rev. 5 privacy      controls.
• Evaluate whether controls are adequately documented, implemented, and operating as intended.
• Identify missing, incomplete, ineffective, or inadequately supported privacy controls.
• Document control-level findings and supporting evidence.
• Develop assessment results that clearly map findings to applicable NIST SP 800-53 Rev. 5      privacy controls.
• Ensure assessment documentation supports defensible conclusions and Government review.

Privacy Documentation Review

Review and analyze privacy documentation including, as applicable:

• Privacy Impact Assessments (PIAs)
• Systems of Records Notices (SORNs)
• Privacy Act Statements
• Data inventories
• Privacy policies and procedures
• Privacy control documentation
• Information collection and data-use documentation
• Data-flow documentation
• Records retention practices
• Data-sharing practices
• Data minimization practices
• Privacy risk documentation
• Plans of Action and Milestones (POA&Ms)

Risk Analysis and Remediation

• Identify and evaluate privacy-related risks and control deficiencies.
• Assign risk ratings using Low, Moderate, and High classifications, as applicable.
• Determine the operational and compliance significance of identified findings.
• Develop prioritized, practical, and actionable remediation recommendations.
• Support development or refinement of POA&Ms for missing, incomplete, or inadequate controls and documentation.
• Recommend resources, processes, documentation, or control improvements needed to address outstanding privacy issues.
• Ensure recommendations are traceable to assessment evidence and applicable NIST privacy controls.
• Develop final findings, risk ratings, and recommendations suitable for inclusion in a formal federal privacy assessment report.

Stakeholder Engagement

• Conduct interviews and working sessions with agency Privacy Office personnel, system owners, information system security personnel, program stakeholders, and other relevant subject matter experts.
• Request, review, and validate assessment evidence.
• Resolve evidence gaps and clarify control implementation through structured stakeholder engagement.
• Communicate preliminary observations and findings clearly and professionally.
• Support Government review and adjudication of draft findings.
• Incorporate Government feedback into finalized assessment conclusions and recommendations.

Reporting and Executive Communication

• Prepare draft and final privacy assessment documentation that clearly describes:
  • Assessment scope and methodology
  • Control assessment results
  • Findings and supporting evidence
  • Risk ratings
  • Control deficiencies
  • Recommended corrective actions
  • Remediation priorities
• Produce a final privacy assessment report suitable for federal Government acceptance.
• Develop and deliver an executive-level briefing summarizing significant findings, risks, recommendations, and remediation priorities.
• Translate detailed privacy-control findings into concise, decision-ready information for senior leadership.
• Ensure all assessment documentation and presentation materials comply with applicable Section 508 accessibility requirements.

Required Qualifications

Candidates must meet all of the following requirements:

Certification

• Active Certified Information Privacy Professional/United States (CIPP/US) certification maintained through the International Association of Privacy Professionals (IAPP).

Federal Privacy Assessment Experience

• Minimum five years of experience conducting privacy assessments for federal agencies.
• Demonstrated experience evaluating federal privacy programs, privacy controls, and associated documentation.
• In-depth understanding of compliance issues associated with federal privacy legislation, directives, regulations, policies, and federal guidance.
• Demonstrated experience planning and executing privacy assessments from initial scoping through final findings and executive reporting.

NIST Privacy Assessment Experience

• Minimum five years of experience utilizing NIST SP 800-53 Rev. 5 privacy-assessor knowledge and application.
• Demonstrated experience reviewing documentation used by a federal Privacy Office to satisfy applicable NIST SP 800-53 Rev. 5 privacy controls.
• Experience assessing privacy controls within a mid-sized federal agency or comparable environment with a Moderate security categorization.
• Demonstrated ability to determine whether privacy controls are adequately documented, implemented, supported by objective evidence, and operating effectively.
• Experience developing control assessment results that map findings to specific NIST SP 800-53 Rev. 5 privacy controls.

Remediation and Reporting Experience

• Experience developing and/or supporting Plans of Action and Milestones (POA&Ms) addressing missing, incomplete, or inadequate controls and documentation.
• Experience developing actionable remediation recommendations for federal Privacy Offices.
• Experience preparing formal privacy assessment reports that document assessment methodology, findings, supporting evidence, risk ratings, and recommendations.
• Experience incorporating Government review comments into final assessment documentation.
• Experience developing and delivering executive-level briefings summarizing privacy risks, findings, and remediation priorities.
• Ability to communicate technical and regulatory privacy issues to both technical stakeholders and executive leadership.

Required Knowledge and Competencies

The successful candidate should demonstrate strong working knowledge of:

• NIST SP 800-53 Rev. 5 privacy controls
• Federal privacy program assessment methodologies
• Privacy Act requirements
• Privacy Impact Assessments
• Systems of Records Notices
• Privacy Act Statements
• Federal data inventories
• Privacy risk analysis
• Privacy control testing and evidence evaluation
• Data minimization
• Records retention
• Information sharing
• Data-flow analysis
• POA&M development and remediation tracking
• Federal privacy legislation, regulations, directives, policies, and guidance
• Risk-based assessment methodology
• Federal information-system environments
• Federal assessment reporting and executive communication

Security and Suitability Requirements

• Must be eligible to successfully complete a National Agency Check with Inquiries (NACI).
• Must comply with all Government requirements governing access to, handling of, transmission of, storage of, and disclosure of sensitive, proprietary, Privacy Act, and other Government information.
• Must maintain strict confidentiality of information obtained during assessment activities.
• An active DoD Secret clearance is preferred, but not required.

Desired Qualifications

• Experience serving as lead assessor for independent federal privacy program assessments.
• Experience supporting a federal agency Privacy Office or Senior Agency Official for Privacy.
• Experience assessing Moderate-impact federal systems or agency environments.
• Experience developing evidence matrices, control assessment workpapers, findings registers, risk      registers, and remediation roadmaps.
• Experience presenting assessment results to senior federal executives.
• Additional privacy, cybersecurity, risk management, audit, or information security certifications.
• Experience integrating privacy assessment activities with broader RMF, FISMA, governance, risk, and compliance programs.
• Active DoD Secret clearance.