Security Control Assessor II (SCA II)

Targeted Solutions, LLC•Bedford, MA

14h

About The Position

The Security Control Assessor (SCA) conducts comprehensive assessments of the management, operational, and technical security controls used by or inherited by information systems (ISs). The assessor determines whether controls are correctly implemented, operating as intended, and achieving the desired security outcomes; evaluates the severity of identified weaknesses; and recommends corrective actions. The role covers Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities within the customer's area of responsibility, with particular emphasis on integrating existing SAP network infrastructure. The SCA oversees security-program policy development, implementation, and evaluation; assesses systems under the Risk Management Framework (RMF) and Joint Special Access Program (SAP) Implementation Guide (JSIG); and advises system and security stakeholders and authorizing officials. The position evaluates authorization packages, threats, vulnerabilities, security documentation, system changes, hardware and software, and continuous monitoring plans. It also prepares security assessment reports and plans of action, supports government inspections and incident response, and represents the customer on inspection teams.

Requirements

Bachelor's degree or equivalent experience (4 years).
7–9 years of related experience.
4 or more years of experience in SAP, SCI, or Collateral information-systems security and implementation of regulations identified in the duties.
Prior performance in the role of ISSO, ISSM, or SCA.
Top Secret clearance with SCI eligibility.
IAM Level II training, in lieu of IAT Level III.

Responsibilities

Oversee development, implementation, and evaluation of information-system security program policy, with particular emphasis on integrating existing SAP network infrastructure.
Assess information systems using the Risk Management Framework (RMF) methodology in accordance with the Joint Special Access Program (SAP) Implementation Guide (JSIG).
Advise the Information System Owner (ISO), Information Data Owner (IDO), Program Security Officer (PSO), and Delegated and/or Authorizing Official (DAO/AO) on assessment and authorization issues.
Evaluate authorization packages and recommend authorization decisions to the AO and/or DAO.
Evaluate information-system threats and vulnerabilities to determine whether additional safeguards are required.
Advise the Government on confidentiality, integrity, and availability impact levels for system information.
Ensure security assessments are completed and documented, and prepare the Security Assessment Report (SAR) for the authorization boundary.
Initiate a Plan of Action and Milestones (POA&M) documenting identified weaknesses for each assessed authorization boundary, based on SAR findings and recommendations.
Evaluate security assessment documentation and provide written recommendations for security authorization to the Government.
Discuss authorization recommendations and submit the security authorization package to the AO/DAO.
Assess proposed changes to authorization boundaries, operating environments, and mission needs to determine whether operations may continue.
Review and concur with sanitization and clearing procedures in accordance with government guidance and policy.
Assist the Government with compliance inspections.
Assist the Government with cybersecurity-related security incidents and ensure appropriate corrective measures are taken.
Ensure organizations address and conduct all phases of the system development life cycle (SDLC).
Evaluate hardware and software to determine their security impact on authorization boundaries.
Evaluate the effectiveness and implementation of continuous monitoring plans.
Represent the customer on inspection teams.