Security Control Assessor (SCA) III

General Dynamics Information Technology•Tucson, AZ

1d•Onsite

About The Position

The Security Control Assessor (SCA) III conducts comprehensive assessments of the management, operational, and technical security controls employed within or inherited by information systems (IS). The role determines whether controls are correctly implemented, operating as intended, and effective in meeting system security requirements; assesses the severity of identified weaknesses and recommends corrective actions. Work covers Collateral, Sensitive Compartmented Information (SCI), and Special Access Program (SAP) activities within the customer’s area of responsibility. The position performs security-program oversight and IS assessments using the Risk Management Framework (RMF) and Joint Special Access Program (SAP) Implementation Guide (JSIG). It advises system and security officials on assessment and authorization matters, evaluates authorization packages and recommends authorization decisions, identifies security threats and vulnerabilities, and prepares security assessment documentation, including Security Assessment Reports (SARs) and Plans of Action and Milestones (POA&Ms). The SCA also evaluates proposed system changes, sanitization procedures, security incidents, hardware and software, continuous monitoring, and system development life-cycle practices; supports compliance inspections and joint Cross-Domain Solution assessments.

Requirements

At least 9 years of related experience.
At least 2 years of SAP experience.
At least 9 years of experience in SAP, SCI, or Collateral information-system security and implementation of applicable regulations.
Prior experience in the role of ISSO, ISSM, or SCA.
Bachelor’s degree in a related discipline; or an associate degree in a related area plus 2 years of experience; or equivalent experience (4 years).
IAT or IAM Level III or IAAE Level I certification within 6 months of hire; examples include CISSP, CASP+ CE, CCNP Security, and CISA.
Must currently possess Top Secret/SCI clearance and be able to attain TS/SCI with CI polygraph.
U.S. citizenship required.
Must be able to regularly lift 50 pounds.
Expert knowledge of DoD, national, and applicable service and agency security policies, manuals, and standards.
Ability to work in a dynamic environment and interact effectively with DoD, military and civilian personnel, and industry partners.
Mastery of Microsoft Office, including Word, PowerPoint, and Excel.

Responsibilities

Oversee development, implementation, and evaluation of information-system security program policy, with special emphasis on integrating existing SAP network infrastructure.
Assess information systems using the Risk Management Framework methodology in accordance with the Joint Special Access Program Implementation Guide.
Advise the Information System Owner, Information Data Owner, Program Security Officer, and Delegated and/or Authorizing Official on assessment and authorization issues.
Evaluate authorization packages and recommend authorization decisions to the Authorizing Official and/or Delegated Authorizing Official.
Evaluate information-system threats and vulnerabilities to determine whether additional safeguards are required.
Advise the Government on Confidentiality, Integrity, and Availability impact levels for system information.
Ensure security assessments are completed and documented, and prepare Security Assessment Reports for authorization boundaries.
Initiate Plans of Action and Milestones for assessed authorization boundaries based on SAR findings and recommendations.
Evaluate security-assessment documentation and provide written recommendations for security authorization to the Government.
Discuss authorization recommendations and submit security authorization packages to the Authorizing Official or Delegated Authorizing Official.
Assess proposed changes to authorization boundaries, operating environments, and mission needs to determine whether operation may continue.
Review and concur with sanitization and clearing procedures in accordance with Government guidance and policy.
Assist the Government with compliance inspections and cybersecurity-related security incidents, ensuring appropriate corrective measures are taken.
Ensure organizations address and conduct all phases of the system development life cycle.
Evaluate hardware and software for potential security impacts on authorization boundaries.
Evaluate the effectiveness and implementation of Continuous Monitoring Plans.
Maintain working knowledge of information systems and network appliances operating at Protection Levels 3 and 4, and distinguish among Cross-Domain Solution types.
Assist with joint Cross-Domain Solution assessments with other Department of Defense agencies.