Federal Privacy Assessor (CIPP/US Certified)

ENDICTUS is seeking an experienced Federal Privacy Assessor to lead an independent assessment of a federal agency privacy program. The selected professional will evaluate the effectiveness and maturity of privacy policies, procedures, controls, documentation, and operational practices, with particular emphasis on NIST SP 800-53 Revision 5 privacy controls.

The Privacy Assessor will review Privacy Impact Assessments (PIAs), Systems of Records Notices (SORNs), Privacy Act Statements, data inventories, policies, procedures, and supporting control evidence; assess implementation and effectiveness of applicable privacy controls; identify privacy risks and control deficiencies; develop actionable remediation recommendations; and prepare assessment documentation and executive-level findings.

This position requires substantive hands-on federal privacy assessment experience. General cybersecurity, RMF, or security-control experience alone is not sufficient unless it includes direct privacy-control assessment responsibilities.

Key Responsibilities

Privacy Program Assessment

• Plan and execute an independent assessment of a federal agency privacy program.
• Develop and maintain an assessment plan defining scope, methodology, schedule, assessment activities, evidence requirements, and stakeholder engagement.
• Evaluate the design, implementation, and effectiveness of applicable privacy controls.
• Review the agency's privacy governance structure, policies, procedures, standards, and supporting artifacts.
• Assess whether documented privacy practices align with applicable federal requirements and agency procedures.
• Identify gaps, weaknesses, inconsistencies, and areas of privacy risk.
• Maintain objective, evidence-based traceability between assessment criteria, supporting evidence, findings, risk ratings, and recommendations.

NIST SP 800-53 Rev. 5 Privacy Control Assessment

• Assess applicable NIST SP 800-53 Rev. 5 privacy controls.
• Review evidence demonstrating control implementation and effectiveness.
• Map agency privacy documentation and practices to applicable NIST SP 800-53 Rev. 5 privacy      controls.
• Evaluate whether controls are adequately documented, implemented, and operating as intended.
• Identify missing, incomplete, ineffective, or inadequately supported privacy controls.
• Document control-level findings and supporting evidence.
• Develop assessment results that clearly map findings to applicable NIST SP 800-53 Rev. 5      privacy controls.
• Ensure assessment documentation supports defensible conclusions and Government review.

Privacy Documentation Review

Review and analyze privacy documentation including, as applicable:

• Privacy Impact Assessments (PIAs)
• Systems of Records Notices (SORNs)
• Privacy Act Statements
• Data inventories
• Privacy policies and procedures
• Privacy control documentation
• Information collection and data-use documentation
• Data-flow documentation
• Records retention practices
• Data-sharing practices
• Data minimization practices
• Privacy risk documentation
• Plans of Action and Milestones (POA&Ms)

Risk Analysis and Remediation

• Identify and evaluate privacy-related risks and control deficiencies.
• Assign risk ratings using Low, Moderate, and High classifications, as applicable.
• Determine the operational and compliance significance of identified findings.
• Develop prioritized, practical, and actionable remediation recommendations.
• Support development or refinement of POA&Ms for missing, incomplete, or inadequate controls and documentation.
• Recommend resources, processes, documentation, or control improvements needed to address outstanding privacy issues.
• Ensure recommendations are traceable to assessment evidence and applicable NIST privacy controls.
• Develop final findings, risk ratings, and recommendations suitable for inclusion in a formal federal privacy assessment report.

Stakeholder Engagement

• Conduct interviews and working sessions with agency Privacy Office personnel, system owners, information system security personnel, program stakeholders, and other relevant subject matter experts.
• Request, review, and validate assessment evidence.
• Resolve evidence gaps and clarify control implementation through structured stakeholder engagement.
• Communicate preliminary observations and findings clearly and professionally.
• Support Government review and adjudication of draft findings.
• Incorporate Government feedback into finalized assessment conclusions and recommendations.

Reporting and Executive Communication

• Prepare draft and final privacy assessment documentation that clearly describes:
  • Assessment scope and methodology
  • Control assessment results
  • Findings and supporting evidence
  • Risk ratings
  • Control deficiencies
  • Recommended corrective actions
  • Remediation priorities
• Produce a final privacy assessment report suitable for federal Government acceptance.
• Develop and deliver an executive-level briefing summarizing significant findings, risks, recommendations, and remediation priorities.
• Translate detailed privacy-control findings into concise, decision-ready information for senior leadership.
• Ensure all assessment documentation and presentation materials comply with applicable Section 508 accessibility requirements.

Required Qualifications

Candidates must meet all of the following requirements:

Certification

• Active Certified Information Privacy Professional/United States (CIPP/US) certification maintained through the International Association of Privacy Professionals (IAPP).

Federal Privacy Assessment Experience

• Minimum five years of experience conducting privacy assessments for federal agencies.
• Demonstrated experience evaluating federal privacy programs, privacy controls, and associated documentation.
• In-depth understanding of compliance issues associated with federal privacy legislation, directives, regulations, policies, and federal guidance.
• Demonstrated experience planning and executing privacy assessments from initial scoping through final findings and executive reporting.

NIST Privacy Assessment Experience

• Minimum five years of experience utilizing NIST SP 800-53 Rev. 5 privacy-assessor knowledge and application.
• Demonstrated experience reviewing documentation used by a federal Privacy Office to satisfy applicable NIST SP 800-53 Rev. 5 privacy controls.
• Experience assessing privacy controls within a mid-sized federal agency or comparable environment with a Moderate security categorization.
• Demonstrated ability to determine whether privacy controls are adequately documented, implemented, supported by objective evidence, and operating effectively.
• Experience developing control assessment results that map findings to specific NIST SP 800-53 Rev. 5 privacy controls.

Remediation and Reporting Experience

• Experience developing and/or supporting Plans of Action and Milestones (POA&Ms) addressing missing, incomplete, or inadequate controls and documentation.
• Experience developing actionable remediation recommendations for federal Privacy Offices.
• Experience preparing formal privacy assessment reports that document assessment methodology, findings, supporting evidence, risk ratings, and recommendations.
• Experience incorporating Government review comments into final assessment documentation.
• Experience developing and delivering executive-level briefings summarizing privacy risks, findings, and remediation priorities.
• Ability to communicate technical and regulatory privacy issues to both technical stakeholders and executive leadership.

Required Knowledge and Competencies

The successful candidate should demonstrate strong working knowledge of:

• NIST SP 800-53 Rev. 5 privacy controls
• Federal privacy program assessment methodologies
• Privacy Act requirements
• Privacy Impact Assessments
• Systems of Records Notices
• Privacy Act Statements
• Federal data inventories
• Privacy risk analysis
• Privacy control testing and evidence evaluation
• Data minimization
• Records retention
• Information sharing
• Data-flow analysis
• POA&M development and remediation tracking
• Federal privacy legislation, regulations, directives, policies, and guidance
• Risk-based assessment methodology
• Federal information-system environments
• Federal assessment reporting and executive communication

Security and Suitability Requirements

• Must be eligible to successfully complete a National Agency Check with Inquiries (NACI).
• Must comply with all Government requirements governing access to, handling of, transmission of, storage of, and disclosure of sensitive, proprietary, Privacy Act, and other Government information.
• Must maintain strict confidentiality of information obtained during assessment activities.
• An active DoD Secret clearance is preferred, but not required.

Desired Qualifications

• Experience serving as lead assessor for independent federal privacy program assessments.
• Experience supporting a federal agency Privacy Office or Senior Agency Official for Privacy.
• Experience assessing Moderate-impact federal systems or agency environments.
• Experience developing evidence matrices, control assessment workpapers, findings registers, risk      registers, and remediation roadmaps.
• Experience presenting assessment results to senior federal executives.
• Additional privacy, cybersecurity, risk management, audit, or information security certifications.
• Experience integrating privacy assessment activities with broader RMF, FISMA, governance, risk, and compliance programs.
• Active DoD Secret clearance.