Security Control Assessor (SCA) DARPA

Position Overview

The Cybersecurity Specialist / Program Information Technology (PIT) Security Control Assessor (SCA) will work on complex, multi‑level classified systems for DARPA. The role requires expertise in DoD and Intelligence Community policies, successful completion of a DoD‑approved CISSP certification (DoD 8570.1‑M), and relevant experience at the Information Assurance Technical (IAT) Level III or Information Assurance Management (IAM) Level II level. The specialist will operate autonomously with DARPA program managers, technical teams, defense industry partners, and government/military stakeholders, participating in collateral, SCI, and SAP assessment and authorization events for developmental and operational information systems.

Location & Work Details

DARPA Headquarters, 675 North Randolph Street, Arlington, VA 22203 (one block from Ballston Mall). Work can be performed on‑site at DARPA HQ or remotely. Travel up to 25 % (mostly domestic/CONUS). Business‑casual dress code. Core hours: 7:00 am – 4:00 pm. Parking: pay‑to‑park at Ballston Mall or surrounding streets. Metro: Ballston‑MU Station (four blocks away).

Key Requirements

• 30‑day notice required for resignation.
• Security clearance: Top Secret with SCI eligibility.
• DoD‑approved CISSP certification in accordance with DoD 8570.1‑M.
• Relevant work experience as specified for IAT Level III or IAM Level II per DoD Manual 8570.1‑M.
• Experience with DoD platforms, weapons systems, or subsystems during research & development cycles (highly desirable).
• Familiarity with a broad set of DoD, NSA, NIST, and CNSS policies and directives (see posting for full list).

Responsibilities

• Ensure system security requirements are addressed throughout all DARPA program life‑cycle phases (concept development, RFI, RFP/BAA, proposal, award, closeout, transition, etc.).
• Plan, prepare, and execute inspections, authorizations, and approvals (A&A) events for networks of all classifications, including development of Automated Information System Authorization and Approval Packages.
• Develop, review, endorse, and recommend actions to authorizing officials (AO, DAO, DAA) for system certification documentation.
• Conduct quality‑control reviews of accreditation packages within three business days of receipt.
• Process authorization, approval, or denial documentation to the appropriate authority within ten business days of receiving a complete package.
• Perform security control assessments to verify correct implementation, operation, and effectiveness of controls against security requirements.
• Assess severity of weaknesses, recommend corrective actions, and document findings.
• Analyze and support DARPA‑accredited network Configuration Control Board cases within ten calendar days of case validation.
• Monitor activities of DARPA‑accredited and DAO‑accredited networks, providing threat analysis, vulnerability assessments, and risk‑mitigation recommendations.
• Conduct certification tests to verify functional assurances and support accreditation.
• Collaborate with the MSO/Information Technology Directorate (ITD) on authorization, continuous monitoring, and management of DARPA unclassified and classified networks, including DMSS, DPN, DSN/SIPRNet, DJN/JWICS, DSWAN, and SAVANNAH.
• Review and recommend changes to policy, procedures, and strategy related to information security.
• Evaluate Information Assurance (IA) products and provide written risk and adoption recommendations for the DARPA IA mission.
• Assess IT vulnerabilities and ensure appropriate safeguards and certifications are applied.
• Develop and maintain a formal Information Systems Security Program SOP.
• Ensure all ISSOs, network administrators, and AIS personnel receive required technical and security training.
• Implement an information security education, training, and awareness program, including delivering local AIS security training.
• Maintain a repository for all system certification/accreditation documentation and modifications.
• Coordinate AIS security inspections, tests, and reviews.
• Prepare policies and procedures for responding to security incidents, investigating violations, and reporting incidents.
• Verify that corrective measures are taken when incidents or vulnerabilities are discovered.
• Assess changes in systems, environments, or operational needs that could affect accreditation.
• Maintain configuration management for security‑relevant AIS software, hardware, and firmware.
• Perform system audits, working closely with system administrators to ensure compliance with approved policies.
• Provide training for secure file transfers and trusted downloads between systems of differing security levels.
• Offer technical advice and oversight on telecommunications requirements for collateral, SAP, and SCI systems and networks.
• Collaborate with SID Emergency Management to review and contribute AIS security input to DARPA emergency/disaster plans and procedures.

Required Skills (Knowledge, Skills, Abilities)

• Relevant work experience as specified for IAT Level III or IAM Level II in DoD Manual 8570.1‑M.
• Extensive knowledge of the Risk Management Framework (RMF).
• Experience assessing and authorizing a wide range of PIT systems (space, manned/unmanned aircraft, underwater vessels, cyber operation platforms, directed‑energy systems, handheld battlefield devices, etc.) at all classification levels.
• Strong interpersonal and communication skills to build confidence with PSOs, PMs, SETAs, technical leadership, and industry/government partners.