Security Control Assessor (SCA)
Core
Independently assess management, operational, and technical security controls throughout information systems lifecycles to determine control effectiveness and support Authorization and Accreditation (A&A) decisions for government and intelligence systems.
Role type
Senior IC Security Control Assessor (A&A)
Builds
Security Assessment Reports, Risk Management Framework (RMF) documentation, and authorization packages for classified systems.
Domain
Defense & Intelligence / Information Assurance
Required skills
Information systems Assessment and Authorization (A&A), Risk management strategies, Security control assessment, RMF compliance, Technical report writing, Security policy development, System vulnerability assessment, Stakeholder coordination
Preferred skills
Emerging technologies implementation, Security directives development, Security plan review
Technologies
Hardware, IAM, Network Security, Matrix
Responsibilities
Review system security plans and verify control statuses in RMF tools; Identify and assess security weaknesses, evaluate threats, and recommend corrective actions; Conduct or support site visits to inspect and verify information system reports; Prepare Security Assessment Reports documenting findings and authorization recommendations; Collaborate with Information Security Officers to initiate Plans of Action and Milestones; Review and approve Security Assessment Plans including control traceability matrices.
Seniority
Senior, hands-on IC
