Security Control Assessor II

About the role

The Security Control Assessor (SCA) conducts comprehensive assessments of the management, operational, and technical security controls employed within or inherited by an information system (IS). The SCA determines the overall effectiveness of the controls, evaluates the severity of weaknesses, and recommends corrective actions to address identified vulnerabilities. Responsibilities cover Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities within the customer’s area of responsibility.

Responsibilities

• Perform oversight of the development, implementation, and evaluation of IS security program policy, with special emphasis on integration of existing SAP network infrastructure.
• Assess information systems based upon the Risk Management Framework (RMF) or the JAFAN 6/3 process.
• Advise the Government on assessment and authorization issues, as well as on assessment methodologies and processes.
• Evaluate authorization packages and make recommendations to the Authorizing Official (AO) and/or Designated Approving Official (DAO) for authorization.
• Evaluate IS threats and vulnerabilities to determine whether additional safeguards are required.
• Advise the Government concerning impact levels for Confidentiality, Integrity, and Availability for system information.
• Review and approve the IS Security Assessment Plan, which includes the SSP, SCTM, and Security Control Assessment Procedures.
• Ensure security assessments are completed for each IS.
• Prepare the final Security Assessment Report (SAR) containing results and findings at the conclusion of each assessment activity.
• Initiate a Plan of Action and Milestones (POA&M) with identified weaknesses and suspense dates based on SAR findings.
• Evaluate security assessment documentation and provide written recommendations for security authorization to the Government.
• Develop recommendations for authorization and submit the security authorization package to the Government.
• Assess proposed changes to ISs, their environment of operation, and mission needs that could affect system authorization.
• Ensure approved procedures are in place for clearing, purging, declassifying, and releasing IS memory, media, and output.
• Assist the Government in compliance inspections and with security incidents related to cybersecurity, ensuring proper corrective measures are taken.
• Assess changes within the IS boundary that could affect the authorization of the boundary.
• Ensure IS requirements are addressed during all phases of the system life cycle.

Requirements

• Ten (10) to twelve (12) years of related experience.
• Bachelor’s degree in a related area or equivalent experience (four (4) years).
• Minimum of four (4) years’ experience in SAP and Collateral Information Systems security and implementation of related regulations.
• Must meet DoD Directive 8570.01‑M certification requirements for Information Assurance Technician Level 3 or Information Assurance Manager Level 3 within six months of hire.
• Current Top Secret clearance with SCI eligibility.
• Eligibility for access to Special Access Programs.
• Willingness to submit to a Counterintelligence Polygraph.

Skills

• Familiarity with current security policies and manuals.
• Ability to work in a dynamic environment and interact effectively with DoD, military/civilian personnel, and industry partners.
• Working knowledge of Microsoft Office (Word, PowerPoint, Excel).
• High degree of originality, creativity, and initiative requiring minimal supervision.
• Willingness to travel extensively within the organizational geographic Area of Responsibility, using both air and ground transportation.
• Excellent customer service skills via phone and face‑to‑face interaction.
• Excellent written and oral command of English.

Physical Requirements

• Ability to sit, bend, reach, stoop, squat, stand, and walk as needed.
• Ability to lift up to 50 lb.