Security Control Assessor (SCA) III

General Dynamics Information Technology•Tucson, AZ

3d•$149,469 - $202,170•Onsite

About The Position

The Security Control Assessor (SCA) III conducts comprehensive assessments of the management, operational, and technical security controls employed within or inherited by information systems (IS). The role determines whether controls are implemented correctly, operating as intended, and producing the desired outcomes for meeting system security requirements. The SCA assesses the severity of identified weaknesses or deficiencies and recommends corrective actions. The position covers Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities within the customer’s area of responsibility. It performs security oversight and Risk Management Framework (RMF) assessments in accordance with the Joint Special Access Program (SAP) Implementation Guide (JSIG), evaluates authorization documentation and system risks, and advises government and program stakeholders on security authorization and compliance matters. This is an onsite position in Tucson, Arizona, with 40 scheduled weekly hours and 10–25% travel required. The role requires an active TS/SCI clearance and the ability to attain TS/SCI with a CI polygraph. The likely salary range is $149,469–$202,170, with actual compensation dependent on experience, geographic location, and potentially contractual requirements.

Requirements

At least nine years of related experience.
At least two years of SAP experience.
At least nine years of experience in SAP, SCI, or Collateral information-system security and implementation of applicable regulations.
Prior performance in the role of ISSO, ISSM, or SCA.
Bachelor’s degree in a related discipline; or an associate’s degree in a related area plus two years of experience; or equivalent experience (four years).
IAT or IAM Level III, or IAAE Level I certification, such as CISSP, CASP+ CE, CCNP Security, or CISA, within six months of hire.
U.S. citizenship.
Must currently possess TS/SCI clearance and be able to attain TS/SCI with a CI polygraph.
Expert knowledge of DoD, national, and applicable service and agency security policies, manuals, and standards.
Ability to work in a dynamic environment and effectively interact with DoD personnel, military and civilian personnel, and industry partners.
Mastery of Microsoft Office, including Word, PowerPoint, and Excel.
Ability to regularly lift 50 pounds.

Responsibilities

Conduct assessments of information-system security controls and determine their effectiveness.
Assess the severity of security weaknesses and deficiencies and recommend corrective actions.
Perform oversight of information-system security program policy development, implementation, and evaluation, with emphasis on integrating existing SAP network infrastructure.
Assess information systems using RMF methodology in accordance with the JSIG.
Advise the Information System Owner, Information Data Owner, Program Security Officer, and Delegated and/or Authorizing Official on assessment and authorization issues.
Evaluate authorization packages and recommend authorization decisions to the Authorizing Official and/or Delegated Authorizing Official.
Evaluate information-system threats and vulnerabilities to determine whether additional safeguards are required.
Advise the Government on confidentiality, integrity, and availability impact levels for system information.
Ensure security assessments are completed and documented, and prepare Security Assessment Reports for authorization boundaries.
Initiate Plans of Action and Milestones for assessed authorization boundaries based on Security Assessment Report findings and recommendations.
Evaluate security assessment documentation and provide written recommendations for security authorization to the Government.
Discuss authorization recommendations and submit security authorization packages to the Authorizing Official or Delegated Authorizing Official.
Assess proposed changes to authorization-boundary operating environments and mission needs to determine whether operations may continue.
Review and concur with sanitization and clearing procedures in accordance with Government guidance and policy.
Assist with Government compliance inspections.
Assist the Government with cybersecurity-related security incidents and ensure appropriate corrective measures are taken.
Ensure organizations address and conduct all phases of the system development life cycle.
Evaluate hardware and software for their security impact on authorization boundaries.
Evaluate the effectiveness and implementation of Continuous Monitoring Plans.
Maintain working knowledge of information systems and network appliances operating at Protection Levels 3 and 4.
Differentiate among Cross-Domain Solution types and assist with joint Cross-Domain Solution assessments with other DoD agencies.