Security Control Assessor II (SCA II)

Targeted Solutions, LLC•Lincoln, MA

About The Position

The Security Control Assessor (SCA) conducts comprehensive assessments of the management, operational, and technical security controls employed within or inherited by an information system (IS). The assessments determine whether controls are implemented correctly, operating as intended, and producing the desired outcomes for meeting system security requirements. The SCA assesses the severity of weaknesses or deficiencies in the IS and its operating environment and recommends corrective actions to address vulnerabilities. Work covers Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities within the customer’s area of responsibility. The position performs oversight of IS security program policy development, implementation, and evaluation, with special emphasis on integrating existing SAP network infrastructure. It assesses systems using the Risk Management Framework (RMF) in accordance with the Joint Special Access Program (SAP) Implementation Guide (JSIG), evaluates authorization packages and documentation, and provides recommendations to the Government and Authorizing Official (AO) or Delegated Authorizing Official (DAO). The SCA also evaluates threats, vulnerabilities, system changes, hardware and software, continuous monitoring, and security procedures, and supports Government inspections and cybersecurity incident response.

Requirements

Bachelor’s degree or equivalent experience (4 years).
7–9 years of related experience.
At least 4 years of experience in SAP, SCI, or Collateral Information Systems security and implementation of regulations identified in the duties.
Prior performance in the role of ISSO, ISSM, or SCA.
Top Secret clearance with SCI eligibility.
IAM Level II training (in lieu of IAT Level III).

Responsibilities

Oversee development, implementation, and evaluation of IS security program policy, with special emphasis on integration of existing SAP network infrastructure.
Assess information systems using the Risk Management Framework (RMF) in accordance with the Joint Special Access Program (SAP) Implementation Guide (JSIG).
Advise the Information System Owner (ISO), Information Data Owner (IDO), Program Security Officer (PSO), and Delegated and/or Authorizing Official (DAO/AO) on assessment and authorization issues.
Evaluate authorization packages and recommend authorization to the AO and/or DAO.
Evaluate IS threats and vulnerabilities to determine whether additional safeguards are required.
Advise the Government on information-system impact levels for Confidentiality, Integrity, and Availability.
Ensure security assessments are completed and documented, and prepare the Security Assessment Report (SAR) for the authorization boundary.
Initiate a Plan of Action and Milestones (POA&M) identifying weaknesses for each assessed authorization boundary, based on SAR findings and recommendations.
Evaluate security assessment documentation and provide written recommendations for security authorization to the Government.
Discuss authorization recommendations and submit the security authorization package to the AO/DAO.
Assess proposed changes to authorization boundaries, operating environments, and mission needs to determine whether operations may continue.
Review and concur with sanitization and clearing procedures in accordance with Government guidance and/or policy.
Assist the Government with compliance inspections.
Assist the Government with cybersecurity-related security incidents and ensure proper corrective measures have been taken.
Ensure the organization addresses and conducts all phases of the system development life cycle (SDLC).
Evaluate hardware and software to determine their security impact on authorization boundaries.
Evaluate the effectiveness and implementation of Continuous Monitoring Plans.
Represent the customer on inspection teams.