Security Controls Assessor

SAIC•Springfield, VA

1d•Onsite

About The Position

SAIC is seeking a highly skilled and motivated Senior Security Control Assessor (SCA) to support cybersecurity assessment and compliance needs for mission-critical IT systems on the MAJESTIC Joint Program Office (JPO) Team. The role independently assesses security controls for compliance with federal cybersecurity policies, standards, and frameworks, including the Risk Management Framework (RMF) and NIST SP 800-53, helping manage and mitigate risks to sensitive and classified systems. The assessor works with Information System Security Managers (ISSMs), Information System Owners (ISOs), system administrators, system engineers, ISSOs, and other stakeholders on technical reviews, security control evaluations, and Authorization and Accreditation (A&A) efforts. This position supports on-premises enterprise IT environments and requires all work to be conducted on-site in Springfield, Virginia. Responsibilities and compensation vary based on the subcontract agreement; compensation is described as competitive and aligned with market rates and role-specific requirements.

Requirements

Meet Cybersecurity Workforce Framework ID 612 (Security Control Assessor) requirements through one or more of the listed qualifying certifications or through a bachelor's degree in Cybersecurity, Computer Science, IT, or a related field.
Have 5–9 years of professional experience managing and supporting enterprise-level IT environments.
Have an active TS/SCI clearance and the ability to obtain and maintain a TS/SCI with Poly.
Be a U.S. citizen.
Work on-site in Springfield, Virginia.
Have familiarity with enterprise IT environments, including Windows Server 2019, MS SQL databases, and Linux distributions (RHEL preferred).
Have knowledge of incident response functions, security architecture, and penetration-testing frameworks such as METASPLOIT and Kali Linux.
Have strong analytical and documentation skills, including the ability to author comprehensive Security Assessment Reports and other system artifacts.

Nice To Haves

Familiarity with enterprise IT environments, including Windows Server 2019, MS SQL databases, and Linux distributions (RHEL preferred).
Knowledge of incident response functions, security architecture, and penetration-testing frameworks such as METASPLOIT and Kali Linux.
Strong analytical and documentation skills, including the ability to author comprehensive Security Assessment Reports and other system artifacts.

Responsibilities

Conduct independent, objective assessments of IT systems to validate security-control compliance with NIST 800-53, RMF, DoD 8510.01, and other applicable federal cybersecurity regulations.
Review and assess Authorization Boundary Diagrams, Risk Assessment Reports, Security Plan Packages, STIG checklists, vulnerability scan results, POA&Ms, and other A&A security artifacts.
Lead Control Implementation Review and Test (CIRT) procedures and system-level security assessments of technical, operational, and management controls.
Recommend system authorization status to Authorizing Officials based on assessment results, residual risks, and applicable policy compliance.
Analyze vulnerability scan results, including those from ACAS, Nessus, or Qualys, and help present vulnerability-management posture to stakeholders.
Perform continuous-monitoring assessments to identify risks, verify ongoing compliance, and document changes affecting system security posture.
Assess and validate security hardening practices using DISA STIGs or CIS Benchmarks across systems, applications, and networks.
Conduct risk analysis and recommend mitigation strategies and control adjustments to reduce threats to system operations and data integrity.
Work with system engineers, ISSOs, and stakeholders to resolve vulnerabilities and ensure timely risk remediation.
Recommend improvements to security-control assessment processes, tools, and documentation.
Compile and present Security Assessment Reports (SARs), risk-assessment summaries, and other reports to senior stakeholders.
Maintain current knowledge of cybersecurity threats, technologies, regulatory frameworks, and compliance practices.