Security Control Assessor II

General Dynamics Information Technology•Albuquerque, NM

2d•Onsite

About The Position

The Security Control Assessor (SCA) conducts comprehensive assessments of management, operational, and technical security controls used by or inherited by information systems (IS). The role determines whether controls are correctly implemented, operating as intended, and achieving the required security outcomes; assesses the severity of weaknesses and deficiencies; and recommends corrective actions. Responsibilities cover Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities within the customer’s area of responsibility. The SCA oversees IS security program policy development, implementation, and evaluation, with emphasis on integrating existing SAP network infrastructure. The role assesses systems using the Risk Management Framework (RMF) in accordance with the Joint Special Access Program Implementation Guide (JSIG), advises system and security officials on assessment and authorization matters, evaluates authorization packages, and makes authorization recommendations. The SCA evaluates threats, vulnerabilities, security impacts, and proposed changes to authorization boundaries; documents assessment results; prepares Security Assessment Reports (SARs) and Plans of Action and Milestones (POA&Ms); and supports Government compliance inspections and cybersecurity incident response. This is an onsite position in Albuquerque, New Mexico, with 40 scheduled weekly hours and 10–25% travel. A Top Secret/SCI clearance is required to start, and the employee must be willing to sit for a CI polygraph. The position requires regularly lifting 50 pounds.

Requirements

At least 7 years of related experience.
Prior performance in the role of ISSO, ISSM, or SCA.
At least 4 years of experience in SAP, SCI, or Collateral information systems security and implementation of the regulations identified in the duties.
Bachelor’s degree in a related discipline, or an associate degree in a related area plus 2 years of experience, or equivalent experience (4 years).
Information Assurance Technician Level III or Information Assurance Manager Level II certification within 6 months of hire.
Currently possess a Top Secret/SCI clearance; must be willing to sit for a CI polygraph.
U.S. citizenship required.
Must be able to regularly lift 50 pounds.
Skills listed: computer security, information assurance, information security, information security management, and information system security.
Certifications listed: CASP CE+ (CompTIA) and CCNP (Cisco).

Responsibilities

Oversee development, implementation, and evaluation of information system security program policy, with emphasis on integrating existing SAP network infrastructure.
Assess information systems using the Risk Management Framework methodology in accordance with the Joint Special Access Program Implementation Guide.
Advise the Information System Owner, Information Data Owner, Program Security Officer, and Delegated and/or Authorizing Official on assessment and authorization issues.
Evaluate authorization packages and recommend authorization decisions to the Authorizing Official and/or Delegated Authorizing Official.
Evaluate information system threats and vulnerabilities to determine whether additional safeguards are required.
Advise the Government on Confidentiality, Integrity, and Availability impact levels for system information.
Ensure security assessments are completed and documented, and prepare the Security Assessment Report for each authorization boundary.
Initiate a Plan of Action and Milestones identifying weaknesses for each assessed authorization boundary, based on Security Assessment Report findings and recommendations.
Evaluate security assessment documentation and provide written recommendations for security authorization to the Government.
Discuss authorization recommendations and submit security authorization packages to the Authorizing Official or Delegated Authorizing Official.
Assess proposed changes to authorization boundaries, operating environments, and mission needs to determine whether operations may continue.
Review and concur with sanitization and clearing procedures in accordance with Government guidance and policy.
Assist the Government with compliance inspections and cybersecurity-related security incidents, ensuring appropriate corrective measures are taken.
Ensure organizations address and conduct all phases of the system development life cycle.
Evaluate hardware and software to determine their security impact on authorization boundaries.
Evaluate the effectiveness and implementation of continuous monitoring plans.
Represent the customer on inspection teams.