Security Controls Assessor

SAIC•Newington, VA

2d•Onsite

About The Position

SAIC is seeking a highly skilled Senior Security Control Assessor (SCA) to support cybersecurity assessment and compliance for mission-critical IT systems on the MAJESTIC Joint Program Office (JPO) Team. The role conducts independent assessments of security controls to evaluate compliance with federal cybersecurity policies, standards, and frameworks, including the Risk Management Framework (RMF) and NIST SP 800-53, and to manage risks to sensitive and classified systems. The SCA works closely with Information System Security Managers (ISSMs), Information System Owners (ISOs), system administrators, engineers, ISSOs, and other stakeholders. Duties include technical reviews, control testing, continuous monitoring, risk analysis, vulnerability assessment, and support for Authorization and Accreditation (A&A) efforts. The position provides formal authorization recommendations and assessment reports to senior stakeholders. All work is conducted on-site in Springfield, Virginia, supporting on-premises enterprise IT environments that include virtualized Windows servers, MS SQL Server databases, and networking layers. This is a subcontractor role; responsibilities and compensation vary by subcontract agreement, with a competitive salary aligned to market rates and role-specific requirements.

Requirements

Meet Cybersecurity Workforce Framework (CWF) ID 612 Security Control Assessor requirements through one or more qualifying certifications or, alternatively, a bachelor’s degree in Cybersecurity, Computer Science, IT, or a related field.
Hold one or more qualifying certifications: CGRC; (C)ISSO-A; CompTIA Cloud+; CompTIA PenTest+; CompTIA Security+; CompTIA SecurityX (formerly CASP+); FITSP-A; GIAC GCSA; GIAC GSEC; CCISO; CISM; CISA; CISSP; CompTIA CySA+; GIAC GSLC; GIAC GSNA; or ISSEP, unless meeting the stated degree alternative.
Have 5–9 years of professional experience managing and supporting enterprise-level IT environments.
Have an active TS/SCI clearance and the ability to obtain and maintain a TS/SCI with Poly.
Be a U.S. citizen.
Have familiarity with enterprise IT environments, including Windows Server 2019, MS SQL databases, and Linux distributions (RHEL preferred).
Have knowledge of incident response functions, security architecture, and penetration-testing frameworks such as Metasploit and Kali Linux.
Have strong analytical and documentation skills, including the ability to author comprehensive Security Assessment Reports and other system artifacts.

Nice To Haves

Familiarity with enterprise IT environments, including Windows Server 2019, MS SQL databases, and Linux distributions (RHEL preferred).
Knowledge of incident response functions, security architecture, and penetration-testing frameworks such as Metasploit and Kali Linux.
Strong analytical and documentation skills, including the ability to author comprehensive Security Assessment Reports and other system artifacts.

Responsibilities

Conduct independent, objective assessments of IT systems against NIST 800-53, RMF, DoD 8510.01, and other applicable federal cybersecurity requirements.
Review Authorization Boundary Diagrams (ABDs), Risk Assessment Reports (RARs), Security Plan Packages (SSPs), STIG checklists, vulnerability scan results, POA&Ms, and other A&A security artifacts.
Lead Control Implementation Review and Test (CIRT) procedures and system-level security assessments of technical, operational, and management controls.
Provide formal recommendations on system authorization status to Authorizing Officials based on assessment results, residual risks, and policy compliance.
Analyze vulnerability scan results from tools such as ACAS, Nessus, or Qualys and help present the organization’s vulnerability management posture to stakeholders.
Perform continuous monitoring assessments, identify risks, ensure ongoing compliance, and document changes affecting system security posture.
Assess and validate security hardening practices using DISA STIGs or CIS Benchmarks across systems, applications, and networks.
Conduct risk analysis and recommend risk mitigation strategies and control adjustments to reduce threats to system operations and data integrity.
Coordinate with system engineers, ISSOs, and stakeholders to resolve vulnerabilities and support timely risk remediation.
Recommend improvements to security control assessment processes, tools, and documentation.
Compile and present Security Assessment Reports (SARs) and risk assessment summaries to senior stakeholders.
Maintain current expertise in cybersecurity threats, technologies, regulatory frameworks, and compliance best practices.