Security Control Assessor - Validator; SCA-V

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Arlington, VA, US

5 days ago Requisition

Position
: Security Control Assessor
- Validator (SCA-V)

Clearance Requirements
: Active Secret Clearance

Primary Location
:
Arlington, VA and/or Mechanicsburg, Pennsylvania, with assignments in Arlington, Virginia, as required.

We are seeking a Security Control Assessor
- Validator (SCA-V) to serve as an independent verification and validation agent for security controls on critical government information systems. In this role, you will be instrumental in supporting the Authorizing Official (AO) by conducting independent, compliant, and comprehensive security control assessments.

Your primary objective will be to ensure the accuracy and integrity of assessment evidence, moving beyond simple acceptance of automated outputs to provide a true, risk-informed picture of a system's security posture. You will be a key player in the authorization process, ensuring that all findings are validated, all risks are clearly communicated, and all decisions are supported by trustworthy evidence within the Enterprise Mission Assurance Support Service (eMASS).

Key Responsibilities:

• Independent Assessment Execution
  :
  Conduct comprehensive Security Control Assessments in accordance with the assessment schedule and the Security Assessment Plan (SAP). This includes interviewing personnel, examining documentation, inspecting configurations, and performing technical testing of implemented controls.
• Critical Validation of Evidence
  :
  Independently validate and critically analyze the accuracy of all test results, including outputs from automated scanning tools, penetration tests, and manual checks. You will ensure all evidence is valid, relevant, and correctly interpreted before it is documented as a formal finding.
• Proactive Communication
  :
  Maintain a "no surprises" approach by providing timely and continuous status updates to the government SCA and ISSM throughout the assessment lifecycle. You will be responsible for the immediate notification of critical or high-risk findings upon discovery.
• Compliance as Code (CaC) Validation
  :
  Apply expert-level knowledge to review and validate security controls defined and executed through Compliance as Code (CaC) frameworks. You will assess the accuracy of CaC profiles and scripts, validate that automated evidence is trustworthy and not prone to false positives/negatives, and verify its correct ingestion into eMASS.
• eMASS System of Record Management
  :
  Maintain master-level proficiency in eMASS, utilizing it as the authoritative system of record. You will accurately and timely document all assessment activities, findings, evidence, and results, including updating control status, populating test results, and uploading objective evidence.
• Risk Analysis and Mitigation Support
  :
  Perform in-depth risk analysis on identified vulnerabilities, assessing the likelihood of exploitation and potential mission impact. You will provide clear, actionable mitigation recommendations and collaborate with system owners to review, refine, and validate Plan of Action and Milestones (POA&M) documentation.
• Authorization Package Development
  :
  Prepare and assemble the comprehensive Security Authorization Package for submission. You will develop the detailed Security Assessment Report (SAR) and be available to brief the SCA, ISSM, and other stakeholders on assessment results to support the final authorization recommendation.

Required Qualifications:

• Experience
  : 5+ years of direct experience in cybersecurity, with a focus on security control assessment, validation, and independent verification.
• Knowledge
  :
  In-depth knowledge of the Risk Management Framework (RMF), NIST SP 800-53, and DISA Security Technical Implementation Guides (STIGs).
• Technical Skills
  :
  Proven experience with eMASS is required. Demonstrated expertise in validating and interpreting data from automated assessment tools (e.g., AWS Inspector, Security Hub, ACAS, Nessus).
• Analytical Skills
  :
  Exceptional analytical and critical thinking skills, with a proven ability to independently verify evidence and distinguish significant risks from low-impact findings.
• Communication
  :
  Excellent written and verbal communication skills, with experience drafting formal Security Assessment Reports (SAR) and briefing senior leadership.
• Clearance:
  Active Secret security clearance…