Security Control Assessor II

General Dynamics Information Technology•Albuquerque, NM

1d•$129,965 - $175,835•Onsite

About The Position

The Security Control Assessor (SCA) conducts comprehensive assessments of management, operational, and technical security controls employed within or inherited by information systems (IS). The role determines whether controls are implemented correctly, operating as intended, and producing the outcomes needed to meet system security requirements. The SCA assesses the severity of identified weaknesses and deficiencies and recommends corrective actions. Work covers Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities within the customer’s area of responsibility. The SCA oversees information-system security programs and performs assessments under the Risk Management Framework (RMF), consistent with the Joint SAP Implementation Guide (JSIG). The role advises system and program stakeholders and government officials on assessment, authorization, risk, and security issues; evaluates authorization packages and documentation; and prepares assessment findings and recommendations. The position is onsite in Albuquerque, New Mexico, with 40 scheduled hours per week and 10–25% travel. A current TS/SCI clearance is required, and the employee must be willing to sit for a CI polygraph.

Requirements

At least 7 years of related experience.
Prior performance in the role of ISSO, ISSM, or SCA.
At least 4 years of experience in SAP, SCI, or Collateral information-system security and implementation of the regulations identified in the duties.
Bachelor’s degree in a related discipline; or an associate’s degree in a related area plus 2 years of experience; or equivalent experience (4 years).
Information Assurance Technician Level III or Information Assurance Manager Level II certification, to be obtained within 6 months of hire.
Currently possess a TS/SCI clearance; must be willing to sit for a CI polygraph.
U.S. citizenship required.
Must be able to regularly lift 50 pounds.
Skills listed: Computer Security, Information Assurance, Information Security, Information Security Management, and Information System Security.

Responsibilities

Oversee development, implementation, and evaluation of information-system security program policy, with emphasis on integration of existing SAP network infrastructure.
Assess information systems using the Risk Management Framework methodology and in accordance with the Joint SAP Implementation Guide (JSIG).
Advise the Information System Owner (ISO), Information Data Owner (IDO), Program Security Officer (PSO), and Delegated and/or Authorizing Official (DAO/AO) on assessment and authorization issues.
Evaluate authorization packages and recommend authorization decisions to the AO and/or DAO.
Evaluate information-system threats and vulnerabilities to determine whether additional safeguards are required.
Advise the Government on Confidentiality, Integrity, and Availability impact levels for system information.
Ensure security assessments are completed and documented, and prepare the Security Assessment Report (SAR) for the authorization boundary.
Initiate a Plan of Action and Milestones (POA&M) documenting identified weaknesses for each assessed authorization boundary, based on SAR findings and recommendations.
Evaluate security assessment documentation and provide written security authorization recommendations to the Government.
Discuss authorization recommendations and submit the security authorization package to the AO/DAO.
Assess proposed changes to authorization-boundary operating environments and mission needs to determine whether operations may continue.
Review and concur with sanitization and clearing procedures in accordance with Government guidance and policy.
Assist the Government with compliance inspections and cybersecurity-related security incidents, ensuring proper corrective measures are taken.
Ensure the organization addresses and conducts all phases of the system development life cycle (SDLC).
Evaluate hardware and software for potential security impacts on authorization boundaries.
Evaluate the effectiveness and implementation of Continuous Monitoring Plans.
Represent the customer on inspection teams.