{bc}
Apply
oracle

Security Controls Assessor

SAIC
Springfield, USA
Mid · 5–9 years experience
Onsite
Discovered Today
linuxsql

Full Job Posting

Key Responsibilities:

  • Conduct independent, objective, and robust assessments of IT systems to validate compliance with security control requirements in alignment with NIST 800-53, RMF, DoD 8510.01, and other applicable federal cybersecurity regulations.
  • Review and assess Authorization Boundary Diagrams (ABDs), Risk Assessment Reports (RARs), Security Plan Packages (SSPs), STIG checklists, vulnerability scan results, POA&Ms, and other security artifacts required for A&A efforts.
  • Lead Control Implementation Review and Test (CIRT) procedures and system-level security assessments to evaluate the adequacy of technical, operational, and management security controls.
  • Provide formal recommendations on system authorization status to Authorizing Officials (AOs), based on assessment results, residual risks, and system compliance to applicable policies.
  • Analyze and interpret vulnerability scan results (e.g., from ACAS, Nessus, or Qualys) and assist in presenting the organization’s vulnerability management posture to relevant stakeholders.
  • Perform continuous monitoring assessments of information systems to identify risks, ensure ongoing compliance, and document changes impacting the security posture of systems.
  • Assess and validate security hardening practices using the DISA STIGs or CIS Benchmarks across systems, applications, and networks.
  • Conduct risk analysis and recommend risk mitigation strategies and control adjustments to minimize threats to system operations and data integrity.
  • Interface with system engineers, ISSOs, and stakeholders to resolve identified vulnerabilities and ensure timely remediation of risks.
  • Provide recommendations to improve current processes, tools, and documentation for security control assessments.
  • Compile and present comprehensive reports, including Security Assessment Reports (SARs) and risk assessment summaries, to senior stakeholders for decision-making.
  • Maintain up-to-date expertise on cybersecurity threats, technologies, regulatory frameworks, and compliance best practices.

Required Qualifications:

  • Certifications (CWF Requirements):
  • Candidates must satisfy Cybersecurity Workforce Framework (CWF) ID 612 (Security Control Assessor) requirements, as outlined by Navy COOL. This requirement can be met by possessing one or more of the following qualifying certifications:
  • Certified in Governance Risk and Compliance (CGRC)
  • Certified Information Systems Security Officer (C)ISSO-A)
  • CompTIA Cloud+
  • CompTIA PenTest+
  • CompTIA Security+
  • CompTIA SecurityX (formerly CASP+)
  • Federal IT Security Professional-Auditor-NG (FITSP-A)
  • GIAC Cloud Security Automation (GCSA)
  • GIAC Security Essentials Certification (GSEC)
  • Certified Chief Information Security Officer (CCISO)
  • Certified Information Security Manager (CISM)
  • Certified Information Systems Auditor (CISA)
  • Certified Information Systems Security Professional (CISSP)
  • CompTIA Cybersecurity Analyst (CySA+)
  • GIAC Security Leadership Certification (GSLC)
  • GIAC Systems and Network Auditor (GSNA)
  • Information Systems Security Engineering Professional (ISSEP)
  • OR This requirement can be met through:
  • A Bachelor’s Degree in Cybersecurity, Computer Science, IT, or a related field.
  • Candidates must satisfy Cybersecurity Workforce Framework (CWF) ID 612 (Security Control Assessor) requirements, as outlined by Navy COOL.
  • 5-9 years of professional experience managing and supporting enterprise-level IT environments.
  • Knowledge of incident response functions, security architecture, and penetration testing frameworks (e.g., METASPLOIT, Kali Linux).
  • Strong analytical and documentation skills, with the ability to author comprehensive Security Assessment Reports (SARs) and other system artifacts.

Technical Skills:

  • Familiarity with IT environments running enterprise systems, such as Windows Server 2019, MS SQL databases, and Linux distributions (RHEL preferred).
  • Knowledge of incident response functions, security architecture, and penetration testing frameworks (e.g., METASPLOIT, Kali Linux).
  • Strong analytical and documentation skills, with the ability to author comprehensive Security Assessment Reports (SARs) and other system artifacts.

Preferred Qualifications:

  • Familiarity with IT environments running enterprise systems, such as Windows Server 2019, MS SQL databases, and Linux distributions (RHEL preferred).
  • Knowledge of incident response functions, security architecture, and penetration testing frameworks (e.g., METASPLOIT, Kali Linux).
  • Strong analytical and documentation skills, with the ability to author comprehensive Security Assessment Reports (SARs) and other system artifacts.
  • Clearance Requirement:
  • Active TS/SCI clearance with the ability to obtain and maintain a TS/SCI with Poly.
  • Candidate must be US Citizen
  • Work Environment and Notes:
  • On-Site Work: All work must be conducted on-site in Springfield, VA.
  • Program Scope: Supports on-premises enterprise IT environments, including virtualized Windows servers, MS SQL Server databases, and networking layers.
  • Subcontractor Role: Responsibilities and compensation vary based on the subcontract agreement, with a competitive salary aligned to market rates and role-specific requirements.

Apply for this job in 1 click

Skip the repetitive application forms

Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.

Sarah M.James T.Maya R.

Trusted by over 500,000 job seekers on Base Career

Start Free Today

More from this employer

More jobs at SAIC

IT Integrator

Chantilly, USA

Discovered Today

MSP Air Traffic Control Instructor

Minneapolis, USA

Discovered Today

Cloud Operations Lead

, USA

Discovered Today

Program Manager

El Segundo, USA

Discovered Today

Senior RF Systems Engineer

El Segundo, USA

Discovered Today

Information Technology (IT) Continuity of Operations (COOP) Exercise Planner (SETA)

Chantilly, USA

Discovered Today

Acquisition Specialist

El Segundo, USA

Discovered Today

Senior Aviation Analyst

Oklahoma City, USA

Discovered Today