Security Control Assessor

Position Summary

Northern Technologies Group (NTG) is seeking an experienced Security Control Accessor to provide expert-level support to the Department of Defense (DoD) Chief Information Officer's SAP IT Cybersecurity program. This role delivers technical and managerial leadership across RMF activities, system accreditation, and enterprise-wide cyber compliance. The Security Control Accessor will serve as a trusted cybersecurity advisor, managing high-impact assessments and helping to ensure secure operations across highly classified SAP environments.

Essential Duties and Responsibilities

• Lead Risk Management Framework (RMF) activities, including the development, review, and validation of: System Security Plans (SSPs), Security Assessment Plans (SAPs), Plan of Action and Milestones (POA&Ms), Security Assessment Reports (SARs), and Security Control Traceability Matrices (SCTMs)
• Act as an advisor to the Authorizing Official (AO), providing SME input to support Authorization to Operate (ATO) decisions
• Perform system security assessments, documentation reviews, and artifact evaluations in eMASS or equivalent tools
• Validate control inheritance and implementation across hybrid, cloud, AI/ML-enabled, or cross-domain architectures
• Provide technical guidance to system owners, ISSMs, SCAs, and program staff to maintain compliance with DoD cybersecurity mandates
• Assist in development and standardization of SOPs, cybersecurity scorecards, and dashboards
• Support cybersecurity incident response documentation and post-event reporting in classified environments
• Participate in enterprise-wide security initiatives, policy updates (e.g., JSIG revisions), and threat awareness activities
• Serve as eMASS administrator: manage accounts, permissions, workflows, and enterprise-level metrics reporting

Minimum Qualifications (Knowledge, Skills, and Abilities)

• 15 years of experience and a Master's degree in Cybersecurity (or equivalent); alternatively, 17 years of experience with a Bachelor's degree, or 21 years of relevant experience with no degree
• Leadership in RMF/A&A efforts
• Clearance: Active TS/SCI with eligibility for SAP access
• Certifications: Must hold a cybersecurity certification at IAT Level III or IAM Level III (e.g., CISSP, CISM, CASP+)

Physical Demands and Work Environment

• While performing duties, regularly required to talk or hear
• Frequently required to use hands or fingers, handle or feel objects, tools, or controls
• Occasionally required to stand; walk; sit; and reach with hands and arms
• Must occasionally lift and/or move up to 25 pounds
• Specific vision abilities required include close vision, distance vision, and ability to adjust focus
• Noise level in work environment usually low to moderate

Travel

Up to 10% - Local travel within NCR may be required; occasional CONUS travel possible.

Schedule

Standard 8-hour workdays, Monday–Friday (core hours: 9 AM–3 PM). May require occasional travel within the National Capital Region (NCR) and limited CONUS travel. On-call response may be required for critical system issues or classified facility access.