Security Control Assessor Representative (SCA-R)

The SCA-R works with Information System Security Managers (ISSMs), Program Management Offices (PMOs), system owners, technical teams, and Government cybersecurity stakeholders to assess security controls, identify cybersecurity risks, validate system compliance, and support authorization decisions throughout the system lifecycle. The SCA-R performs independent technical and risk-based assessments using Government-approved processes, databases, and cybersecurity tools and develops complete, accurate, and defensible authorization documentation for Government and Authorizing Official (AO) review.

Security Control Assessor Representative (SCA-R)
Alexandria, VA or Ft. Meade, MD
Pay From: $100,000 per year

MUST:
Security Control Assessor Representative (SCA-R)
TS/SCI
Current DoD 8570 IAM Level III certification.
8) years of experience in a cybersecurity or network security position.
(5) years of experience performing Certification and Accreditation (C&A) and/or Assessment and Authorization (A&A) activities.
Bachelor's degree required.
A bachelor's in information technology, Cybersecurity, Computer Science, Information Systems, or related technical field is preferred.

DUTIES:
The Security Control Assessor Representative (SCA-R) provides cybersecurity assessment, Risk Management Framework (RMF), and Assessment and Authorization (A&A) support for Department of Defense (DoD) information systems.
The SCA-R works with Information System Security Managers (ISSMs), Program Management Offices (PMOs), system owners, technical teams, and Government cybersecurity stakeholders to assess security controls, identify cybersecurity risks, validate system compliance, and support authorization decisions throughout the system lifecycle.
The SCA-R performs independent technical and risk-based assessments using Government-approved processes, databases, and cybersecurity tools and develops complete, accurate, and defensible authorization documentation for Government and Authorizing Official (AO) review.
Use Government-assigned tools and databases to perform weekly updates, maintain system records, track assigned actions, and complete cybersecurity assessment and authorization activities.
Coordinate with ISSMs, PMOs, system owners, and technical stakeholders to understand system architectures, security requirements, authorization boundaries, configurations, and system changes.
Conduct risk analysis, security control assessment, and authorization activities across applicable RMF steps using approved RE5 tools and processes.
Verify system authorization boundaries and validate system security categorizations in accordance with FIPS 199 and applicable DoD requirements.
Identify applicable data classifications and conduct system-level cybersecurity risk assessments.
Assess threats, vulnerabilities, control deficiencies, and residual risks and compile findings into complete and accurate authorization packages.
Evaluate proposed and implemented system changes, determine their potential security and authorization impacts, and provide appropriate status and risk information to the Authorizing Official (AO).
Evaluate authorization and change requests, including web-filtering requests, firewall exceptions, ports and protocols, cybersecurity risks, STIG/SRG compliance, and on-site security requirements.
Review and validate compliance with applicable Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), security controls, and cybersecurity requirements.
Review, validate, and track Plans of Action and Milestones (POA&Ms) and associated cybersecurity deficiencies through resolution.
Lead and support on-site assessment visits, including planning, technical assessments, stakeholder coordination, entrance/exit briefings, documentation, findings development, and reporting.
Maintain access to and proficiency with required Government cybersecurity databases, vulnerability assessment platforms, endpoint security solutions, scanning tools, and RMF management systems.
Attend required Government meetings, technical exchanges, and training to remain current with policies, procedures, tools, and RMF process changes.
Complete required assessor, vulnerability scanning, endpoint security, and RMF process training.
Support assigned systems throughout their lifecycle in accordance with FISMA, DoD RMF, and applicable cybersecurity requirements.
Prepare and submit weekly activity reports documenting completed and ongoing activities, tracking identifiers, assessment status, significant findings, risks, issues, and key updates.
Independently assess security control deficiencies and residual risks, evaluate alternative corrective actions, and recommend risk-based remediation priorities.
Advise the Authorizing Official and Government cybersecurity stakeholders on the security risks and operational implications of system changes, exception requests, and authorization decisions. Quadrant is an affirmative action/equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, status as a protected veteran, or status as an individual with a disability. Healthcare benefits are offered to all eligible employees according to compliance mandated by the Affordable Care Act .