Security Control Assessor (SCA) I

About the role

The SCA conducts comprehensive assessments of management, operational, and technical security controls within or inherited by an information system to determine overall effectiveness, identify weaknesses, and recommend corrective actions. Responsibilities cover Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities. GDIT is a global technology and professional services company delivering technology solutions and mission services to U.S. government agencies.

Responsibilities

• Perform oversight of the development, implementation, and evaluation of IS security program policy, with emphasis on integrating existing SAP network infrastructure
• Assess information systems based on the Risk Management Framework (RMF) methodology per the Joint Special Access Program (SAP) Implementation Guide (JSIG)
• Advise the Information System Owner (ISO), Information Data Owner (IDO), Program Security Officer (PSO), and Delegated/Authorizing Official (DAO/AO) on assessment and authorization issues
• Evaluate authorization packages and make recommendations to the AO/DAO for authorization
• Evaluate IS threats and vulnerabilities to determine if additional safeguards are required
• Advise the Government on impact levels for Confidentiality, Integrity, and Availability of system information
• Ensure security assessments are completed, results documented, and prepare the Security Assessment Report (SAR) for the authorization boundary
• Initiate a Plan of Action and Milestones (POA&M) with identified weaknesses for each authorization boundary assessed, based on SAR findings
• Evaluate security assessment documentation and provide written recommendations for security authorization to the Government
• Discuss authorization recommendations and submit the security authorization package to the AO/DAO
• Assess proposed changes to authorization boundaries’ operating environment and mission needs to determine continuation to operate
• Review and concur with all sanitization and clearing procedures per Government guidance/policy
• Assist Government compliance inspections
• Assist Government with cybersecurity‑related security incidents and ensure proper corrective measures are taken
• Ensure organization addresses and conducts all phases of the system development life cycle (SDLC)
• Evaluate hardware and software for security impact on authorization boundaries