Security Controls Assessor (SCA) Representative
for section headings. Use - for any list of duties/requirements/benefits. Use
for prose.
We must not repeat job title as heading. Do not put Job ID as heading.
We need to include sections only when posting has real specific content.
Let's extract:
About the role: The description after title: "KBR is seeking a Security Controls Assessor (SCA) Representative in Colorado Springs, CO area. The individual will directly support the United States Space Force (USSF) Risk Management Framework, Cybersecurity Framework (RMF, CSF) compliance activities to ensure security controls are defined, implemented, and assessed for complex multi-level security architectures of advanced aerospace systems."
That's substantive. We'll put that in
under About the role.
Responsibilities: List of bullet points starting with "Key Responsibilities". We'll extract each sentence after that.
List:
- Conducts independent comprehensive assessments of the management, operational, and technical security controls, and control enhancements implementation within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST SP 800-37).
- Applies RMF/CSF principles to the development of integrated weapon systems.
- Conducts assessment and authorization (A&A) events to support recommendations to the USSF Special Access Program/Special Access Required (SAP/SAR) Authorizing Official (USSF SAP AO) based on requirements, security impact levels and projected/current operational environment.
- Develops Security Assessment Report to support Authorization to Operate decisions.
- Full-time job with frequent US travel required. (maybe schedule but we can include as responsibility? It's more about job nature; but we have schedule section later.)
We'll put these in
- .
Qualifications: There's "Qualifications Required:" list and "Desired Qualifications". We'll combine maybe separate sections? The instruction: Prefer a few substantive sections over many thin ones. Could have Qualifications section covering both required and desired, maybe with subheadings? But we only allowed
for section headings, not subheadings. Could we have two sections: Required Qualifications and Desired Qualifications? That would be thin but maybe okay if they have content. However we could combine into one Qualifications section with two lists: Required and Desired. But we need to use - for any list. Could have a
introducing then two
lists with headings? But we cannot add extra headings besides . Could use inside to denote Required and Desired. That's acceptable.
Thus Qualifications section:
Qualifications
then Required:
then list of required qualifications. Then Desired:
then list.
But we must not repeat job title as heading; fine.
Required qualifications list:
- An active TS/SCI and eligible for SAP/SAR, which is something only a U.S. citizen can obtain.
- Prior experience as a SAP SCA or SAP SCA Representative.
- Ability to travel 20%-50%.
- 5 years of Linux experience in implementation/principles/administration.
- Strong knowledge of RMF/CSF process activities and related documentation (e.g., life-cycle support plans, concept of operations, and operational procedures) to confirm the level of risk is within acceptable limits.
- Demonstrated ability perform cybersecurity assessments, identify gaps in cybersecurity architecture, and develop a security risk management plan that articulates risk to both technical and non-technical audiences.
- Ability to ensure Body of Evidence (BoE) artifacts such as plans of actions and milestones and cybersecurity plans are in place for vulnerabilities/deficiencies identified during risk assessments, audits, inspections, etc.
- Demonstrated history finding unique mitigations to varied systems’ cybersecurity challenges to assess the effectiveness of security controls.
- Demonstrated technical proficiency in at least two of the following areas of security: communications, networks, embedded systems, software, system testing or assessment, etc.
- Strong written and oral communication skills to support necessary compliance activities (e.g., ensure that system security configuration guidelines are followed, compliance monitoring occurs).
- Ability to verify software/network/system security postures are implemented within a DevSecOps process, agile methodology and continuous integration/continuous delivery (CI/CD) pipeline to ensure cybersecurity requirements are included in early during development.
- Demonstrated ability to develop methods to develop methods to monitor and measure risk, compliance, and information assurance efforts. (Note there is a duplicate phrase "develop methods to develop methods" but we keep as is.)
- Certified Information System Security Professional (CISSP).
Desired qualifications list:
- Bachelors or Masters degree in related discipline.
- Certified Cloud Security Professional (CCSP).
- Certified Ethical Hacker (CEH).
- AWS or other cloud technology security certification.
Benefits: KBR offers a selection of competitive lifestyle benefits which could include 401K plan with company match, medical, dental, vision, life insurance, AD&D, flexible spending account, disability, paid time off, or flexible work schedule. We support career advancement through professional training and development.
We'll put that in - .
Pay: Basic Compensation $160,000 - $180,000. This range is for Colorado only. The offered rate will be based on the selected candidate’s knowledge, skills, abilities and/or experience and in consideration of internal parity.
We'll put that in
.
Schedule: Scheduled Weekly Hours 40hrs. Work Environment Location: On-site Travel Requirements: Up to 20-50% Working Hours: Standard.
We'll create Schedule section with
containing: 40 hours per week, standard hours, on-site, travel up to 20-50%.
We must not include boilerplate like "Belong. Connect. Grow." etc. That's marketing fluff but maybe considered substantive? It's repetitive and maybe considered boilerplate. The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The "Belong. Connect. Grow." is marketing but not explicitly listed; but it's somewhat fluff. Might be considered boilerplate? Safer to omit. Also omit "Why Join Us?" etc. Also omit "KBR’s National Security Solutions team provides..." etc. Also omit "We Deliver – Together." and EEO statement.
Thus we keep only core info.
Now produce HTML fragment:
About the role
KBR is seeking a Security Controls Assessor (SCA) Representative in Colorado Springs, CO area. The individual will directly support the United States Space Force (USSF) Risk Management Framework, Cybersecurity Framework (RMF, CSF) compliance activities to ensure security controls are defined, implemented, and assessed for complex multi-level security architectures of advanced aerospace systems.
Responsibilities
- Conducts independent comprehensive assessments of the management, operational, and technical security controls, and control enhancements implementation within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST SP 800-37).
- Applies RMF/CSF principles to the development of integrated weapon systems.
- Conducts assessment and authorization (A&A) events to support recommendations to the USSF Special Access Program/Special Access Required (SAP/SAR) Authorizing Official (USSF SAP AO) based on requirements, security impact levels and projected/current operational environment.
- Develops Security Assessment Report to support Authorization to Operate decisions.
- Full-time job with frequent US travel required.
Qualifications
Required:
- An active TS/SCI and eligible for SAP/SAR, which is something only a U.S. citizen can obtain.
- Prior experience as a SAP SCA or SAP SCA Representative.
- Ability to travel 20%-50%.
- 5 years of Linux experience in implementation/principles/administration.
- Strong knowledge of RMF/CSF process activities and related documentation (e.g., life-cycle support plans, concept of operations, and operational procedures) to confirm the level of risk is within acceptable limits.
- Demonstrated ability perform cybersecurity assessments, identify gaps in cybersecurity architecture, and develop a security risk management plan that articulates risk to both technical and non-technical audiences.
- Ability to ensure Body of Evidence (BoE) artifacts such as plans of actions and milestones and cybersecurity plans are in place for vulnerabilities/deficiencies identified during risk assessments, audits, inspections, etc.
- Demonstrated history finding unique mitigations to varied systems’ cybersecurity challenges to assess the effectiveness of security controls.
- Demonstrated technical proficiency in at least two of the following areas of security: communications, networks, embedded systems, software, system testing or assessment, etc.
- Strong written and oral communication skills to support necessary compliance activities (e.g., ensure that system security configuration guidelines are followed, compliance monitoring occurs).
- Ability to verify software/network/system security postures are implemented within a DevSecOps process, agile methodology and continuous integration/continuous delivery (CI/CD) pipeline to ensure cybersecurity requirements are included in early during development.
- Demonstrated ability to develop methods to develop methods to monitor and measure risk, compliance, and information assurance efforts.
- Certified Information System Security Professional (CISSP).
Desired:
- Bachelors or Masters degree in related discipline.
- Certified Cloud Security Professional (CCSP).
- Certified Ethical Hacker (CEH).
- AWS or other cloud technology security certification.
Benefits
- 401K plan with company match
- Medical, dental, vision
- Life insurance, AD&D
- Flexible spending account
- Disability
- Paid time off
- Flexible work schedule
- Professional training and development
Pay
Basic Compensation $160,000 - $180,000. This range is for Colorado only. The offered rate will be based on the selected candidate’s knowledge, skills, abilities and/or experience and in consideration of internal parity.
Schedule
40 hours per week, standard hours, on-site, travel up to 20-50%.
Check for any duplicated content: We have travel mention in responsibilities and
for prose. We must not repeat job title as heading. Do not put Job ID as heading. We need to include sections only when posting has real specific content. Let's extract: About the role: The description after title: "KBR is seeking a Security Controls Assessor (SCA) Representative in Colorado Springs, CO area. The individual will directly support the United States Space Force (USSF) Risk Management Framework, Cybersecurity Framework (RMF, CSF) compliance activities to ensure security controls are defined, implemented, and assessed for complex multi-level security architectures of advanced aerospace systems." That's substantive. We'll put that in
under About the role. Responsibilities: List of bullet points starting with "Key Responsibilities". We'll extract each sentence after that. List: - Conducts independent comprehensive assessments of the management, operational, and technical security controls, and control enhancements implementation within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST SP 800-37). - Applies RMF/CSF principles to the development of integrated weapon systems. - Conducts assessment and authorization (A&A) events to support recommendations to the USSF Special Access Program/Special Access Required (SAP/SAR) Authorizing Official (USSF SAP AO) based on requirements, security impact levels and projected/current operational environment. - Develops Security Assessment Report to support Authorization to Operate decisions. - Full-time job with frequent US travel required. (maybe schedule but we can include as responsibility? It's more about job nature; but we have schedule section later.) We'll put these in
- .
Qualifications: There's "Qualifications Required:" list and "Desired Qualifications". We'll combine maybe separate sections? The instruction: Prefer a few substantive sections over many thin ones. Could have Qualifications section covering both required and desired, maybe with subheadings? But we only allowed
for section headings, not subheadings. Could we have two sections: Required Qualifications and Desired Qualifications? That would be thin but maybe okay if they have content. However we could combine into one Qualifications section with two lists: Required and Desired. But we need to use
- for any list. Could have a
introducing then two
- lists with headings? But we cannot add extra headings besides
- .
Pay: Basic Compensation $160,000 - $180,000. This range is for Colorado only. The offered rate will be based on the selected candidate’s knowledge, skills, abilities and/or experience and in consideration of internal parity.
We'll put that in
. Schedule: Scheduled Weekly Hours 40hrs. Work Environment Location: On-site Travel Requirements: Up to 20-50% Working Hours: Standard. We'll create Schedule section with
containing: 40 hours per week, standard hours, on-site, travel up to 20-50%. We must not include boilerplate like "Belong. Connect. Grow." etc. That's marketing fluff but maybe considered substantive? It's repetitive and maybe considered boilerplate. The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The "Belong. Connect. Grow." is marketing but not explicitly listed; but it's somewhat fluff. Might be considered boilerplate? Safer to omit. Also omit "Why Join Us?" etc. Also omit "KBR’s National Security Solutions team provides..." etc. Also omit "We Deliver – Together." and EEO statement. Thus we keep only core info. Now produce HTML fragment:
About the role
KBR is seeking a Security Controls Assessor (SCA) Representative in Colorado Springs, CO area. The individual will directly support the United States Space Force (USSF) Risk Management Framework, Cybersecurity Framework (RMF, CSF) compliance activities to ensure security controls are defined, implemented, and assessed for complex multi-level security architectures of advanced aerospace systems.
Responsibilities
- Conducts independent comprehensive assessments of the management, operational, and technical security controls, and control enhancements implementation within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST SP 800-37).
- Applies RMF/CSF principles to the development of integrated weapon systems.
- Conducts assessment and authorization (A&A) events to support recommendations to the USSF Special Access Program/Special Access Required (SAP/SAR) Authorizing Official (USSF SAP AO) based on requirements, security impact levels and projected/current operational environment.
- Develops Security Assessment Report to support Authorization to Operate decisions.
- Full-time job with frequent US travel required.
Qualifications
Required:
- An active TS/SCI and eligible for SAP/SAR, which is something only a U.S. citizen can obtain.
- Prior experience as a SAP SCA or SAP SCA Representative.
- Ability to travel 20%-50%.
- 5 years of Linux experience in implementation/principles/administration.
- Strong knowledge of RMF/CSF process activities and related documentation (e.g., life-cycle support plans, concept of operations, and operational procedures) to confirm the level of risk is within acceptable limits.
- Demonstrated ability perform cybersecurity assessments, identify gaps in cybersecurity architecture, and develop a security risk management plan that articulates risk to both technical and non-technical audiences.
- Ability to ensure Body of Evidence (BoE) artifacts such as plans of actions and milestones and cybersecurity plans are in place for vulnerabilities/deficiencies identified during risk assessments, audits, inspections, etc.
- Demonstrated history finding unique mitigations to varied systems’ cybersecurity challenges to assess the effectiveness of security controls.
- Demonstrated technical proficiency in at least two of the following areas of security: communications, networks, embedded systems, software, system testing or assessment, etc.
- Strong written and oral communication skills to support necessary compliance activities (e.g., ensure that system security configuration guidelines are followed, compliance monitoring occurs).
- Ability to verify software/network/system security postures are implemented within a DevSecOps process, agile methodology and continuous integration/continuous delivery (CI/CD) pipeline to ensure cybersecurity requirements are included in early during development.
- Demonstrated ability to develop methods to develop methods to monitor and measure risk, compliance, and information assurance efforts.
- Certified Information System Security Professional (CISSP).
Desired:
- Bachelors or Masters degree in related discipline.
- Certified Cloud Security Professional (CCSP).
- Certified Ethical Hacker (CEH).
- AWS or other cloud technology security certification.
Benefits
- 401K plan with company match
- Medical, dental, vision
- Life insurance, AD&D
- Flexible spending account
- Disability
- Paid time off
- Flexible work schedule
- Professional training and development
Pay
Basic Compensation $160,000 - $180,000. This range is for Colorado only. The offered rate will be based on the selected candidate’s knowledge, skills, abilities and/or experience and in consideration of internal parity.
Schedule
40 hours per week, standard hours, on-site, travel up to 20-50%.
Check for any duplicated content: We have travel mention in responsibilities and
. Could use inside
to denote Required and Desired. That's acceptable. Thus Qualifications section:
Qualifications
thenRequired:
then- list of required qualifications. Then
Desired:
then- list.
But we must not repeat job title as heading; fine.
Required qualifications list:
- An active TS/SCI and eligible for SAP/SAR, which is something only a U.S. citizen can obtain.
- Prior experience as a SAP SCA or SAP SCA Representative.
- Ability to travel 20%-50%.
- 5 years of Linux experience in implementation/principles/administration.
- Strong knowledge of RMF/CSF process activities and related documentation (e.g., life-cycle support plans, concept of operations, and operational procedures) to confirm the level of risk is within acceptable limits.
- Demonstrated ability perform cybersecurity assessments, identify gaps in cybersecurity architecture, and develop a security risk management plan that articulates risk to both technical and non-technical audiences.
- Ability to ensure Body of Evidence (BoE) artifacts such as plans of actions and milestones and cybersecurity plans are in place for vulnerabilities/deficiencies identified during risk assessments, audits, inspections, etc.
- Demonstrated history finding unique mitigations to varied systems’ cybersecurity challenges to assess the effectiveness of security controls.
- Demonstrated technical proficiency in at least two of the following areas of security: communications, networks, embedded systems, software, system testing or assessment, etc.
- Strong written and oral communication skills to support necessary compliance activities (e.g., ensure that system security configuration guidelines are followed, compliance monitoring occurs).
- Ability to verify software/network/system security postures are implemented within a DevSecOps process, agile methodology and continuous integration/continuous delivery (CI/CD) pipeline to ensure cybersecurity requirements are included in early during development.
- Demonstrated ability to develop methods to develop methods to monitor and measure risk, compliance, and information assurance efforts. (Note there is a duplicate phrase "develop methods to develop methods" but we keep as is.)
- Certified Information System Security Professional (CISSP).
Desired qualifications list:
- Bachelors or Masters degree in related discipline.
- Certified Cloud Security Professional (CCSP).
- Certified Ethical Hacker (CEH).
- AWS or other cloud technology security certification.
Benefits: KBR offers a selection of competitive lifestyle benefits which could include 401K plan with company match, medical, dental, vision, life insurance, AD&D, flexible spending account, disability, paid time off, or flexible work schedule. We support career advancement through professional training and development.
We'll put that in
- .
Pay: Basic Compensation $160,000 - $180,000. This range is for Colorado only. The offered rate will be based on the selected candidate’s knowledge, skills, abilities and/or experience and in consideration of internal parity.
We'll put that in
- for any list. Could have a