Security Control Assessor II

• Conduct comprehensive assessments of management, operational, and technical security controls within or inherited by information systems
• Assess control effectiveness and severity of identified weaknesses or deficiencies
• Recommend corrective actions for identified vulnerabilities
• Cover Collateral, SCI, and SAP activities within the customer’s area of responsibility
• Oversee development, implementation, and evaluation of IS security program policy, including SAP network infrastructure integration
• Assess information systems using RMF methodology in accordance with JSIG
• Advise the ISO, IDO, PSO, DAO/AO on assessment and authorization issues
• Evaluate authorization packages and recommend authorization decisions
• Evaluate system threats and vulnerabilities and determine required safeguards
• Advise the Government on confidentiality, integrity, and availability impact levels
• Complete and document security assessments and prepare Security Assessment Reports
• Initiate POA&Ms for identified weaknesses
• Evaluate assessment documentation and provide written authorization recommendations
• Submit security authorization packages to the AO/DAO
• Assess proposed changes to authorization boundaries, operating environments, and mission needs
• Review and concur with sanitization and clearing procedures
• Assist with Government compliance inspections and cybersecurity security incidents
• Ensure organizations address all phases of the SDLC
• Evaluate hardware and software security impacts on authorization boundaries
• Evaluate continuous monitoring plan effectiveness and implementation
• Represent the customer on inspection teams

• 7+ years of related experience
• Prior performance in the role of ISSO and ISSM or SCA
• Minimum of four (4) years’ experience in SAP, SCI or Collateral Information Systems (IS) Security and implementation of applicable regulations
• Bachelor’s degree in a related discipline OR Associate’s degree in a related area + 2 years’ experience OR equivalent experience (4 years)
• Information Assurance Technician Level III or Information Assurance Manager Level II certification
• Top Secret/SCI clearance required to start
• Must be willing to sit for a CI polygraph
• US Citizenship required
• Skills in Computer Security, Information Assurance, Information Security, and Information Security Management
• 40 scheduled weekly hours
• 10–25% travel required

Demonstrates expertise in conducting security assessments and evaluating information systems using RMF methodology, with a strong focus on compliance and risk management. Proficient in developing and implementing security policies, and providing recommendations for vulnerabilities in SAP, SCI, and Collateral Information Systems.

• Information Security Management
• Risk Management Framework (RMF)
• Security Assessment Reports
• Information Assurance Technician Level III
• Top Secret/SCI Clearance

• Security Assessments
• Vulnerability Assessment
• Control Effectiveness Evaluation
• Security Program Policy Development
• Authorization Package Evaluation
• Continuous Monitoring Plan Evaluation
• System Threat Evaluation
• Sanitization Procedures Review
• Cybersecurity Incident Response
• SDLC Compliance

• Information Assurance Technician Level III
• Information Assurance Manager Level II

• Collateral Information Systems
• Sensitive Compartmented Information (SCI)
• Special Access Program (SAP)
• Confidentiality
• Integrity
• Availability
• POA&Ms
• Government Compliance Inspections
• Cybersecurity
• Top Secret Clearance