Security Control Assessor (SCA) II

General Dynamics Information Technology•Arlington, VA

3d•$153,000 - $207,000•Onsite

About The Position

The Security Control Assessor (SCA) II conducts comprehensive assessments of management, operational, and technical security controls implemented within or inherited by information systems (IS). The role determines whether controls are correctly implemented, operating as intended, and producing the desired outcomes in meeting system security requirements. The SCA assesses the severity of weaknesses and deficiencies and recommends corrective actions for identified vulnerabilities. Work covers Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities within the customer’s area of responsibility. The SCA performs oversight of IS security program policy development, implementation, and evaluation, with special emphasis on integrating existing SAP network infrastructure. The position assesses systems using the Risk Management Framework (RMF) in accordance with the Joint Special Access Program Implementation Guide (JSIG), advises system and program stakeholders on assessment and authorization matters, evaluates authorization packages, and makes recommendations to the authorizing officials and the Government. The role also evaluates threats, vulnerabilities, safeguards, information impact levels, system changes, hardware and software, continuous monitoring, and system development life cycle compliance. The SCA documents assessment results, prepares Security Assessment Reports (SARs), initiates Plans of Action and Milestones (POA&Ms), submits security authorization packages, reviews sanitization and clearing procedures, assists with compliance inspections and cybersecurity incidents, and represents the customer on inspection teams. This is an onsite position in Arlington, Virginia, with 40 scheduled hours per week and 10–25% travel. A Top Secret/SCI clearance is required to start, and the employee must be able to attain TS/SCI with CI polygraph. The position requires regularly lifting 50 pounds.

Requirements

At least 7 years of related experience.
At least 4 years of experience in SAP, SCI, or Collateral IS Security and implementing the regulations identified in the duties.
Prior performance in the role of an ISSO, ISSM, or SCA.
Bachelor’s degree in a related discipline, or an associate’s degree in a related area plus 2 years of experience, or equivalent experience (4 years).
IAT Level III certification (such as CISSP, CASP+ CE, CCNP Security, or CISA) within 6 months of hire.
U.S. citizenship required.
Must possess TS/SCI clearance at start and be able to attain TS/SCI with CI polygraph.
Must be able to regularly lift 50 pounds.
Skills in information security, information security management, and information system security.

Responsibilities

Oversee the development, implementation, and evaluation of IS security program policy, with special emphasis on integrating existing SAP network infrastructure.
Assess information systems using the RMF methodology in accordance with the JSIG.
Advise the Information System Owner, Information Data Owner, Program Security Officer, and Delegated and/or Authorizing Official on assessment and authorization issues.
Evaluate authorization packages and recommend authorization to the AO and/or DAO.
Evaluate IS threats and vulnerabilities to determine whether additional safeguards are required.
Advise the Government concerning Confidentiality, Integrity, and Availability impact levels for system information.
Ensure security assessments are completed and documented, and prepare the Security Assessment Report for the authorization boundary.
Initiate a POA&M documenting identified weaknesses for each assessed authorization boundary, based on SAR findings and recommendations.
Evaluate assessment documentation and provide written security authorization recommendations to the Government.
Discuss authorization recommendations and submit security authorization packages to the AO/DAO.
Assess proposed changes to authorization boundaries, operating environments, and mission needs to determine whether operations may continue.
Review and concur with sanitization and clearing procedures in accordance with Government guidance and policy.
Assist the Government with compliance inspections.
Assist the Government with cybersecurity-related security incidents and ensure proper corrective measures are taken.
Ensure the organization addresses and conducts all phases of the system development life cycle.
Evaluate hardware and software for potential security impact on authorization boundaries.
Evaluate the effectiveness and implementation of Continuous Monitoring Plans.
Represent the customer on inspection teams.

Benefits

401(k) with company match.
Comprehensive health and wellness packages.
Internal mobility team dedicated to helping employees manage their careers.
Professional growth opportunities, including paid education and certifications.
Access to cutting-edge technology and learning opportunities.
Additional paid vacation and holidays.
Medical plan options, including options with Health Savings Accounts.
Dental and vision plan options.
Flexible work weeks where possible.
Paid time off plans including vacation, sick, personal time, holidays, and paid parental, military, bereavement, and jury duty leave.
Short- and long-term disability benefits.
Life, accidental death and dismemberment, personal accident, critical illness, and business travel and accident insurance.