Security Control Assessor (SCA) — Level II

Rividium•Quantico, VA

About The Position

RiVidium Inc. is seeking an experienced Security Control Assessor (SCA) — Level II to serve the team for all Cybersecurity and Intelligence Enterprise Information Technology Services (CIEITS) program activities. The Security Control Assessor (SCA) — Level II serves as a senior technical authority responsible for leading Assessment and Authorization (A&A) activities across the Department of Homeland Security (DHS) Intelligence Enterprise (DHS IE). This position conducts comprehensive security control assessments for classified and unclassified information systems, cloud environments, Cross Domain Solutions (CDS), and C-LAN extension sites in support of the NIST Risk Management Framework (RMF) and DHS/Intelligence Community (IC) cybersecurity requirements. The Security Control Assessor provides expert guidance on security control implementation, risk management, continuous monitoring, and authorization package development while working closely with System Owners, Information System Security Officers (ISSOs), Information System Security Managers (ISSMs), Security Engineers, Government Authorizing Officials (AOs), Security Control Assessor Representatives (SCARs), Branch Chiefs, and the DHS I&A Chief Information Security Officer (CISO). The successful candidate will possess extensive experience leading complex A&A efforts for enterprise systems operating in classified, hybrid, cloud, and Cross Domain Solution environments.

Requirements

Active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance with SAP eligibility.
Minimum 10 years of experience in information security, cybersecurity risk management, or Assessment and Authorization (A&A), including demonstrated experience in: Assessment and Authorization (A&A), Federal Information Security Modernization Act (FISMA) compliance, Intelligence Community cybersecurity policy, Continuous Monitoring (ConMon), Cross Domain Solutions (CDS), Secure cloud and hybrid cloud environments.
Current Certified Information Security Manager (CISM), Certified Authorization Professional (CAP), or comparable Governance, Risk, and Compliance (GRC) certification.
Certified Information Systems Security Professional (CISSP) certification is highly desirable.
Expert knowledge of: NIST Risk Management Framework (RMF), NIST SP 800-37, NIST SP 800-53, NIST SP 800-53A, CNSSI 1253, ICD 503, DHS Sensitive Systems Policy Directive 4300C, Intelligence Community security overlays and authorization requirements.
Experience using Governance, Risk, and Compliance (GRC) platforms such as RSA Archer.
Experience using security assessment and vulnerability management tools, including: Nessus, SCAP, Nmap, WebInspect, SonarQube, Comparable security assessment tools.
Demonstrated experience leading A&A activities for Cross Domain Solutions (CDS), classified information systems, and cloud-based environments.
Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Assurance, or a related technical discipline.
One of the following current certifications is required: Certified Information Security Manager (CISM), Certified Authorization Professional (CAP), Governance, Risk, and Compliance (GRC) Certification.
Active Top Secret/Sensitive Compartmented Information (TS/SCI) Clearance Required.
SAP Eligibility Required.

Nice To Haves

Certified Information Systems Security Professional (CISSP) certification is highly desirable.
AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, Google Professional Cloud Security Engineer, or equivalent cloud security certification.
Experience supporting DHS Intelligence & Analysis (I&A) or other Intelligence Community cybersecurity organizations.
Experience conducting Assessment and Authorization activities for OCONUS locations and C-LAN authorization extension sites.
Experience supporting National Cross Domain Strategy and Management Office (NCDSMO) accreditation requirements and Raise the Bar (RTB) initiatives.
Experience implementing Continuous Authorization (cATO), Agile RMF, or automated security assessment processes.
Knowledge of DevSecOps security controls, Infrastructure as Code (IaC), and cloud-native security assessment methodologies.
Preferred certifications include: Certified Information Systems Security Professional (CISSP), AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, Google Professional Cloud Security Engineer.

Responsibilities

Lead comprehensive Assessment and Authorization (A&A) activities for DHS Intelligence Enterprise information systems operating in Top Secret/Sensitive Compartmented Information (TS/SCI), Secret, and Unclassified environments.
Conduct security assessments for enterprise systems hosted in: On-premises data centers, DHS DICE Commercial Cloud Enterprise (C2E), Intelligence Community (IC) Cloud, AWS GovCloud, Hybrid cloud environments, Cross Domain Solution (CDS) environments, CONUS and OCONUS C-LAN extension sites.
Lead project discovery sessions, kickoff meetings, and stakeholder engagements for new system authorizations, reauthorizations, and major system changes.
Assess the implementation and effectiveness of NIST security controls and document findings within the Security Assessment Report (SAR) and Governance, Risk, and Compliance (GRC) platform.
Identify security control deficiencies, vulnerabilities, and compliance gaps; provide technical recommendations to reduce organizational risk.
Validate the accuracy and completeness of Plans of Action and Milestones (POA&Ms), ensuring corrective actions align with identified assessment findings.
Monitor remediation activities and verify completion of corrective actions before recommending authorization decisions.
Develop and prepare complete Authorization and Assessment packages, including: Authorization to Operate (ATO), Authorization to Connect (ATC), Interim Authorization to Test (IATT), Security Assessment Reports (SARs), Risk Recommendation Memoranda, Risk Management Matrices, Security Assessment Plans (SAPs), Project kickoff memoranda, System Owner acknowledgment letters.
Conduct technical reviews of System Security Plans (SSPs), Contingency Plans, Configuration Management Plans, and supporting RMF documentation.
Maintain and update Assessment and Authorization Standard Operating Procedures (SOPs) for all DHS I&A enclaves, ensuring annual review and compliance with evolving Federal and Intelligence Community requirements.
Participate in Office of Inspector General (OIG), Federal Information Security Modernization Act (FISMA), and Intelligence Community Oversight Program (ICOP) audits, inspections, and cybersecurity assessments.
Represent the program during DHS and Intelligence Community cybersecurity working groups and technical review boards.
Maintain enterprise A&A Project Portfolio Listing Reports and Quarterly A&A Assignment Reports.
Research emerging technologies, cybersecurity standards, and automation opportunities to improve A&A efficiency and support ongoing authorization initiatives.
Prepare executive briefings, risk summaries, technical presentations, and decision support materials for the DHS I&A CISO, Government leadership, and Authorizing Officials.
Mentor junior cybersecurity personnel and provide technical guidance on RMF implementation, security control assessments, and authorization processes.