Security Control Assessor

IP Secure, LLC•San Antonio, TX

7d•Onsite

About The Position

IPSecure is seeking an experienced Security Control Assessor (SCA) to support the 16 AF Assessments and Authorization (A&A) Branch in performing comprehensive assessments under the NIST Risk Management Framework (RMF) in alignment with Intelligence Community Directive (ICD) 503. This role requires hands-on technical expertise in network mapping, vulnerability analysis, and compliance assessments to ensure mission systems meet stringent cybersecurity standards. Candidates must be prepared for 25%–75% travel annually to provide on-site assessment and authorization support for Air Force Intelligence Community systems.

Requirements

6+ years of experience in cybersecurity, information assurance, or related technical fields.
Familiarity with DoD Risk Management Framework (RMF) and ICD 503 compliance standards.
Active TS/SCI clearance (or SCI-eligible).
Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, Information Systems, or related discipline from an ABET-accredited or CAE-designated institution.
Meets DoD 8140 IAT Level II or III requirements (CGRC/CAP, CASP+, Cloud+, PenTest+, GSEC).

Nice To Haves

IAM Level III Certifications (CISSP, CISM, or GSLC) preferred
Hands-on experience with network mapping tools (e.g., Nmap, SolarWinds, or equivalent) and ACAS/Nessus vulnerability scanning.
Strong understanding of network architectures, operating systems, and security configurations across enterprise and tactical environments.

Responsibilities

Perform in-depth network mapping and topology reviews to identify potential attack surfaces, misconfigurations, and unauthorized interconnections.
Conduct vulnerability scans and compliance checks using ACAS (Assured Compliance Assessment Solution) and other DoD-approved tools to identify and validate security weaknesses.
Utilize the Enterprise Mission Assurance Support Service (eMASS) for tracking, managing, and reporting A&A package status and security control compliance.
Analyze multiple operating systems, network environments, and enclave architectures to assess risks across both classified and unclassified domains.
Develop and review security documentation including: Security Assessment Reports (SARs), Risk Assessment Reports (RARs), System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), Security Control Traceability Matrices (SCTMs).
Provide situational awareness and technical risk assessments to stakeholders on accredited and pending accreditation systems.
Collaborate with Authorizing Officials (AOs), Delegated AOs, ISSOs, ISSMs, ISSEs, and Program Managers to ensure alignment with DoD cybersecurity requirements.
Present technical findings and recommendations in briefings, teleconferences, and formal reviews.
Record and distribute meeting minutes, weekly activity reports (WARs), and trip reports within required timelines.
Review and validate documentation prior to submission to AOs/DAOs to support risk-based accreditation decisions.