Security Control Assessor - Validator (SCA-V)
Core
Independently verify and validate security controls on critical government information systems, supporting the authorization process with risk-informed assessments and reliable evidence.
Role type
Senior IC security control assessor (validator)
Builds
Security Authorization Packages and formal Security Assessment Reports (SARs)
Domain
US Government / Defense / Cybersecurity Compliance
Required skills
Risk Management Framework (RMF), NIST SP 800-53, DISA STIGs, eMASS, automated assessment tools (AWS Inspector, Security Hub, ACAS, Nessus), vulnerability analysis, POA&M development, Security Assessment Report writing
Preferred skills
CISSP, CAP, Compliance as Code (CaC) frameworks, ISSO collaboration, Security Authorization Package assembly
Technologies
AWS, SAP
Responsibilities
Conduct Security Control Assessments including interviews, documentation reviews, configuration inspections, and technical testing; Independently examine and validate assessment evidence and test results from automated tools, penetration tests, and manual checks; Review and validate security controls implemented through Compliance as Code frameworks; Use eMASS as the authoritative system of record for documenting activities and results; Analyze vulnerabilities for exploitation likelihood and mission impact; Assemble Security Authorization Packages and brief stakeholders on assessment results
