Security Controls Assessor

Oneida Technical Solutions•Sumter, SC

10d•$100,000 - $120,000•Onsite

About The Position

Oneida Technical Solutions, LLC (OTS) is seeking a Security Controls Assessor to provide cybersecurity support to AFCENT. The position is onsite at Shaw AFB in Sumter, South Carolina, and requires physical travel to contractor and Government sites inside and outside the continental United States. The assessor evaluates management, operational, and technical security controls used by or inherited by information systems and software applications to determine whether controls are implemented correctly, operating as intended, and meeting security requirements. The role performs initial and ongoing security control assessments for AFCENT networks, systems, and applications; supports risk decisions and authorization recommendations; evaluates vulnerabilities, threats, and proposed system changes; and helps prepare security authorization documentation. The assessor uses the Risk Management Framework (RMF) and Government-specified processes to protect information assets and support the AFCENT mission. The position also provides guidance to other assessors and uses assessment findings and trend analysis to improve information assurance training, policies, and processes.

Requirements

Must possess and maintain a Secret clearance.
Must provide proof of IAT-III or IAM-III certification.
For senior (III) and higher positions: a master's degree in a related field and at least 3 years of relevant experience; or a bachelor's degree in a related field and at least 5 years of relevant IT experience; or at least 7 years of relevant IT experience.
For mid-level (II) or lower positions: a bachelor's degree in a related field and at least 1 year of relevant experience; or an associate degree in a related field and at least 3 years of relevant IT experience; or at least 5 years of relevant IT experience.

Nice To Haves

For senior (III) and higher positions, the listed education and experience qualifications are identified as preferred.

Responsibilities

Perform initial and continual security control assessments and validation for AFCENT networks, systems, and software applications.
Use DoD-approved tools, including ACAS, Nessus, HBSS, CMRS, OCRS, and SolarWinds, to generate initial and continuous monitoring reports.
Complete reports to support Authorizing Official (AO) risk decisions, as required or requested.
Assess the severity of weaknesses or deficiencies and recommend corrective actions to address identified vulnerabilities.
Review the System Security Plan (SSP) before assessment and ensure it identifies controls that meet stated security requirements.
Advise the Information System Owner (ISO) on confidentiality, integrity, and availability impact values.
Evaluate threats and vulnerabilities to determine whether additional safeguards are needed.
Assist in creating, reviewing, and approving security assessment plans, including the SSP, Security Controls Traceability Matrix (SCTM), and Security Control Assessment Procedure.
Ensure assessments are completed and controls operate as intended to protect the confidentiality, integrity, and availability of IT resources at appropriate levels.
Help prepare the final Security Assessment Report (SAR) containing assessment results and findings.
Ensure the Information System Security Officer (ISSO) initiates a Plan of Action and Milestones (POA&M) based on SAR findings and recommendations.
Evaluate security assessment documentation and provide written recommendations for security authorization to the AO.
Provide expertise in vulnerability assessments of Platform IT systems.
Help assemble and submit security authorization artifacts to the AO, including at minimum the SSP, SAR, POA&M, and Risk Assessment Report (RAR).
Assess proposed information system or software changes, operating environments, and mission needs to determine whether they are security-relevant and could affect authorization.
Use the RMF methodology to implement an IT process that protects information assets and supports the element's mission.
Guide other assessors on job policies and procedures and provide detailed assessment findings using Government-specified processes and procedures.
Recommend solutions to remediate security vulnerabilities and threats and improve IT resource protection in support of the AFCENT mission.
Use assessment results to identify trends and improve information assurance training, policies, and processes.
Develop reports and trend analyses to support risk assessment decisions.