Security Control Assessor

The Security Control Assessor (SCA) conducts comprehensive assessments of security controls employed by, or inherited within, information systems to determine their overall effectiveness and compliance with applicable security requirements. The SCA develops and submits the complete Body of Evidence (BoE), including the System Security Plan (SSP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), and draft Authorization to Operate (ATO) letter, to the Authorizing Official (AO) or Delegated Authorizing Official (DAO) for review and authorization determination.

The SCA serves as a trusted advisor to key stakeholders, including Program Offices, Data Owners, Information System Security Officers (ISSOs), and Authorizing Officials/Delegated Authorizing Officials, providing guidance on system security categorization and determining appropriate confidentiality, integrity, and availability impact levels in accordance with Risk Management Framework (RMF) requirements.

• Excellent interpersonal, verbal, and written communication skills, with experience collaborating across mixed technical teams and engaging diverse stakeholders.
• Expert-level experience reviewing, analyzing, and interpreting compliance and vulnerability assessment results from tools such as Xacta, STIG Viewer, ACAS, Prisma, Splunk, Trellix (HBSS), and other vulnerability scanners.
• Ability to lead or support security projects and initiatives, manage competing priorities, and contribute effectively in a team-oriented environment.

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field. A Bachelor’s degree may be substituted with an additional four (4) years of directly related experience, for a total of sixteen (16) years of relevant experience.
• Twelve (12) years of experience supporting cybersecurity, Information Assurance, Risk Management Framework (RMF), and Assessment & Authorization (A&A) activities.
• Obtain and maintain an IAT Level III certification in accordance with DoD 8570.01-M and DoD Directive 8140 Cyberspace Workforce Management requirements.