Security Control Assessor (SCA)

Organizational Development Resource Group • Arlington, VA

10d • Onsite

About The Position

ODRG is seeking a Security Control Assessor to perform advanced, data-driven security assessments that provide a continuous, mission-focused understanding of cybersecurity risk. The role partners with the Authorizing Official and influences ongoing authorization decisions for critical systems. Work supports DSCA Risk Management Framework (RMF) and Cybersecurity Risk Management Framework (CSRMF) processes.

The position is based primarily in Mechanicsburg, Pennsylvania, and also in Arlington, Virginia, with assignments in Arlington as required. Work is performed within and outside the National Capital Region. Duties requiring SIPR access must be completed at an approved DSCA facility. An active Secret clearance is required.

Requirements

• At least 5 years of direct cybersecurity experience focused on security control assessment, risk management, or a related field.
• In-depth knowledge of the Risk Management Framework (RMF), NIST SP 800-53, and related publications.
• Ability to analyze security tool data, interpret scan results, and validate automated testing outputs.
• Experience with eMASS.
• Strong analytical and problem-solving skills, including the ability to understand system-specific context and explain risk in clear, mission-focused terms.
• Excellent written and verbal communication skills, including experience drafting formal security assessment reports and briefing senior leadership.
• Active Secret security clearance.

Nice To Haves

• Familiarity with the DoD/Dow Cybersecurity Risk Management Framework (CSRMF).
• Bachelor's degree in Cybersecurity, Information Technology, or a related discipline.
• Relevant certification such as CISSP, CISM, CAP, or equivalent.
• Experience with Policy as Code (PaC) and automating security control validation.
• Experience managing ATO schedules and tracking POA&M remediation efforts.

Responsibilities

• Develop and document Security Assessment Plans (SAP) defining the assessment scope, methodology, resources, and timeline.
• Conduct ongoing assessments of security controls and analyze and correlate security scan, system log, and automated monitoring data to assess system security posture.
• Prioritize vulnerabilities and control deficiencies according to their direct and indirect impact on mission execution, using threat intelligence and system-specific context.
• Interpret and validate automated tool outputs, Policy as Code (PaC) scripts, and traditional evidence; perform manual testing of non-automatable controls and analyze aggregated data for risk trends and systemic weaknesses.
• Develop and maintain authorization artifacts, including Security Assessment Reports (SAR) and Risk Assessment Reports (RAR), and provide risk input for Plans of Action and Milestones (POA&M).
• Synthesize assessment findings and residual system risk into a formal Authorization Recommendation Memo for leadership.
• Manage the program's Authorization to Operate (ATO) schedule, tracking assessments, documentation milestones, and remediation efforts.
• Manage and document assessment activities, evidence, and artifacts in the Enterprise Mission Assurance Support Service (eMASS).

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed