Security Control Assessor

SAIC•Newington, VA

20h•Onsite

About The Position

SAIC is seeking a highly skilled and motivated Senior Security Control Assessor (SCA) to support the cybersecurity assessment and compliance needs of mission-critical IT systems for the MAJESTIC Joint Program Office (JPO) Team. The successful candidate will perform independent assessments of security controls to ensure compliance with federal cybersecurity policies, standards, and frameworks, such as the Risk Management Framework (RMF), NIST SP 800-53, and others, to manage and mitigate risks to sensitive and classified systems. This role will require working closely with Information System Security Managers (ISSMs), Information System Owners (ISOs), and system administrators to conduct technical reviews, evaluate security controls, and assist with Authorization and Accreditation (A&A) efforts. This role requires on-site support in Springfield, VA.

Requirements

Skilled and motivated Senior Security Control Assessor (SCA)
Support cybersecurity assessment and compliance needs of mission-critical IT systems
Perform independent assessments of security controls
Ensure compliance with federal cybersecurity policies, standards, and frameworks (RMF, NIST SP 800-53)
Manage and mitigate risks to sensitive and classified systems
Work closely with Information System Security Managers (ISSMs), Information System Owners (ISOs), and system administrators
Conduct technical reviews
Evaluate security controls
Assist with Authorization and Accreditation (A&A) efforts
On-site support in Springfield, VA

Responsibilities

Conduct independent, objective, and robust assessments of IT systems to validate compliance with security control requirements in alignment with NIST 800-53, RMF, DoD 8510.01, and other applicable federal cybersecurity regulations.
Review and assess Authorization Boundary Diagrams (ABDs), Risk Assessment Reports (RARs), Security Plan Packages (SSPs), STIG checklists, vulnerability scan results, POA&Ms, and other security artifacts required for A&A efforts.
Lead Control Implementation Review and Test (CIRT) procedures and system-level security assessments to evaluate the adequacy of technical, operational, and management security controls.
Provide formal recommendations on system authorization status to Authorizing Officials (AOs), based on assessment results, residual risks, and system compliance to applicable policies.
Analyze and interpret vulnerability scan results (e.g., from ACAS, Nessus, or Qualys) and assist in presenting the organization’s vulnerability management posture to relevant stakeholders.
Perform continuous monitoring assessments of information systems to identify risks, ensure ongoing compliance, and document changes impacting the security posture of systems.
Assess and validate security hardening practices using the DISA STIGs or CIS Benchmarks across systems, applications, and networks.
Conduct risk analysis and recommend risk mitigation strategies and control adjustments to minimize threats to system operations and data integrity.
Interface with system engineers, ISSOs, and stakeholders to resolve identified vulnerabilities and ensure timely remediation of risks.
Provide recommendations to improve current processes, tools, and documentation for security control assessments.
Compile and present comprehensive reports, including Security Assessment Reports (SARs) and risk assessment summaries, to senior stakeholders for decision-making.
Maintain up-to-date expertise on cybersecurity threats, technologies, regulatory frameworks, and compliance best practices.