Security Control Assessor, Lead

Job Number: R0249483

Security Control Assessor, Lead

The Lead Security Control Assessor directs the SCA workstream and provides independent cybersecurity assessment leadership for CDAO systems and environments to the ISSM. The Lead SCA owns assessment strategy, quality standards, stakeholder coordination, risk adjudication, and final review of Security Assessment Plans (SAPs) and Security Assessment Reports (SARs). The position advises technical leadership and Authorizing Official (AO) stakeholders on control effectiveness, authorization readiness, and residual cybersecurity risk.

In this role you will be responsible for developing and governing the assessment approach, schedule, evidence standards, test procedures, and quality-control framework for the SCA team.

• Provide eMASS administration, analyze STIG, SCAP, ACAS findings, POA&Ms, architecture, inherited controls, compensating controls, and technical evidence.
• Work with the project ISSM to understand customer cybersecurity RMF requirements applicable to the systems in their respective environments.
• Lead independent security control assessments in accordance with DoD RMF, NIST guidance, applicable DoD cybersecurity policy, and organizational assessment procedures.
• Brief findings and risk recommendations to the ISSM, AO representative, and AO-level stakeholders.
• Develop all system applicable RMF Body of Evidence (BOE) documentation ensuring accuracy, relevance, and completion to meet requirements and input BOE documentation into AO approved databases such as eMASS or AO specific SharePoint site.
• Review and approve SAPs and SARs for technical accuracy, evidence sufficiency, traceability, consistency, and defensibility before stakeholder delivery.
• Coordinate with system owners, ISSMs and ISSOs, cybersecurity engineers, administrators, developers, program leadership, control providers, and AO representatives.
• Review system boundaries, data flows, external interfaces, interconnections, inherited controls, common-control dependencies, and significant changes.
• Oversee assessment execution for ATO, reauthorization, annual assessment, significant-change assessment, and continuous monitoring activities.
• Brief assessment status, systemic risks, unresolved findings, remediation priorities, and authorization recommendations to senior stakeholders.
• Mentor assessors, calibrate assessment judgments, and ensure independence and objectivity across the assessment lifecycle.
• Develop and maintain strong relationships with stakeholders across the organization

Join us. The world can't wait.

• 8+ years of experience with cybersecurity, including DoD or federal RMF, security assessment, security engineering, or authorization
• Experience with eMASS, analyzing STIG, SCAP, and ACAS findings, POA&Ms, architecture, inherited controls, compensating controls, and technical evidence
• Experience leading security control assessments and producing or approving SSPs, SAPs, SARs, POA&Ms, risk assessments, and authorization packages
• Experience with administration of Windows, Linux, AWS Cloud, and containerization systems and software configuration
• Experience with technical writing, facilitation, quality-assurance, team leadership, and stakeholder-management capabilities
• Knowledge of NIST SP 800-53, NIST SP 800-37, DoD RMF, STIGs, vulnerability management, and security-control assessment methodology
• Ability to evaluate complex enterprises, including cloud, hybrid, containerized data, and AI-enabled architectures, and communicate risks at the AO and executive levels
• Ability to lead, organize, and complete various cybersecurity testing events, including using applicable automated security scanning tools and system required manual STIGs and SRGs, and…