Security Control Assessor

Booz Allen Hamilton•Herndon, VA

About The Position

The Security Control Assessor (SCA) plays a vital role in reviewing and validating the effectiveness of security controls, identifying deficiencies, and assessing residual risk. The SCA will guide stakeholders through the Risk Management Framework (RMF), execute comprehensive assessments, and deliver authoritative recommendations that inform authorization decisions. Experience in analyzing technical evidence and documenting assessment results is essential to enable a cutting-edge U.S. government client that is at the forefront of cyber operations. On the team, the SCA will perform in-depth security control assessments across complex systems, evaluating security documentation, validating implemented controls, and identifying missing details. They will use their curiosity and understanding of evolving cybersecurity threats, cloud technologies, and emerging architectures to identify weaknesses, recommend remediation strategies, and ensure systems meet authorization requirements. Leveraging experience in security engineering principles, cloud security postures, and risk analysis, the SCA will deliver authoritative assessment reports that support authorization decisions and strengthen overall security posture. In this role, the SCA will closely impact a government client with a high operational tempo by supporting cloud security and cybersecurity hygiene and enabling national security through their expertise. With mentoring, challenging hands-on problem-solving, and opportunities to learn new tools and skills, the team focuses on growing to make the best solutions for customers. The role involves implementing infrastructure and cybersecurity controls, including enhanced detection and vulnerability capabilities and improved event correlation in large enterprises. It also includes performing risk and vulnerability assessments in network, system, and application areas, and leveraging big data analytics and traditional security event types to identify advanced threats or indicators of compromise.

Requirements

5+ years of experience using and applying the National Institute for Standards and Technology (NIST) Special Publication (SP) 800-53
Experience conducting security control assessments, including documentation review, interviews, and technical testing
Knowledge of technology security controls and the network accreditation process
TS/SCI clearance with a polygraph
HS diploma or GED

Nice To Haves

Experience with cloud networking providers, including Amazon Web Services (AWS), Oracle, Microsoft, or Google
Experience with assessment or authorization tools such as Xacta
Experience with scanning tools, including Nessus, Rapid7, or Nipper
Experience communicating the complexities of security with a wide variety of audiences, including senior management

Responsibilities

Implement infrastructure and cybersecurity controls, including enhanced detection and vulnerability capabilities and improved event correlation in large enterprises.
Perform risk and vulnerability assessments in network, system, and application areas.
Leverage big data analytics and traditional security event types to identify advanced threats or indicators of compromise.
Review and validate the effectiveness of security controls.
Identify security control deficiencies.
Assess residual risk.
Guide stakeholders through the Risk Management Framework (RMF).
Execute comprehensive assessments.
Deliver authoritative recommendations that inform authorization decisions.
Analyze technical evidence and document assessment results.
Perform in-depth security control assessments across complex systems.
Evaluate security documentation.
Validate implemented controls.
Identify missing details in security documentation.
Identify weaknesses in systems.
Recommend remediation strategies.
Ensure systems meet authorization requirements.
Deliver authoritative assessment reports.
Support authorization decisions.
Strengthen overall security posture.
Support cloud security and cybersecurity hygiene.
Monitor and assess risk on Plans of Action and Milestones (POA&M) items.