Security Control Assessor

Crest Security Assurance; Fort Lee (NJ); On-site; USD 90,000 - 95,000; Full time

Job summary

Crest Security Assurance seeks a Security Control Assessor to support the DCMA CSS contract in Fort Lee, NJ. You will independently assess security controls for classified and unclassified information systems per DoDI 8510.01, RMF, NIST 800-53/800-53A, and provide evidence and risk-based recommendations for authorization decisions and continuous monitoring.

Responsibilities include planning and executing SAPs, reviewing security artifacts, documenting findings in SARs/SCARs/RARs, validating

Qualifications

• Active Secret security clearance.
• At least 5-7 years of related cybersecurity, RMF, security control assessment, or information assurance experience.
• DoD IAM III certification(s) (one of the following):

Responsibilities

• Develop and execute Security Assessment Plans (SAPs) with defined scope, methodology, procedures, schedules, and evidence requirements.
• Assess controls via documentation review, interviews, observation, testing, and analysis of artifacts (vulnerability scans, STIG checklists, baselines, continuous monitoring).
• Document assessment results in SARs/SCARs/RARs with evidence and traceability.
• Review POA&Ms, evaluate mitigations, and perform closure validation or follow-up testing.
• Maintain results, control status, evidence, and authorization records in eMASS and report risk/performance metrics to DCMA leadership.

Job description

Salary Range: $90,000.00 To $95,000.00 Annually

Support the Defense Contract Management Agency (DCMA) Cybersecurity Support Services (CSS) contract by independently assessing security controls for classified and unclassified information systems. Plan and execute security control assessments in accordance with DoDI 8510.01, the DoD Risk Management Framework (RMF), NIST SP 800-53, and NIST SP 800-53A, and provide objective evidence and risk-based recommendations to support authorization decisions and continuous monitoring.

Responsibilities:

• Develop and execute Security Assessment Plans (SAPs), including assessment scope, methodology, procedures, schedules, and evidence requirements, in coordination with system owners, Information System Security Officers (ISSOs), Information System Security Managers (ISSMs), and Authorizing Official staff.
• Assess implemented technical, operational, and management security controls through documentation review, interviews, observation, testing, and analysis of artifacts such as vulnerability scan results, Security Technical Implementation Guide (STIG) checklists, configuration baselines, and continuous monitoring records.
• Document assessment results, findings, and residual risk in Security Assessment Reports (SARs), Security Control Assessment Reports (SCARs), Risk Assessment Reports (RARs), and related RMF artifacts; validate that findings are accurate, traceable, and supported by sufficient evidence.
• Review Plans of Action and Milestones (POA&Ms) and remediation evidence, evaluate proposed mitigations, and perform closure validation or follow-up testing to confirm that identified weaknesses have been effectively addressed.
• Maintain assessment results, control status, evidence, and authorization documentation in the Enterprise Mission Assurance Support Service (eMASS); track assessment activities and provide status, risk, and performance metrics to DCMA leadership.

Requirements:

• Active Secret security clearance
• At least 5-7 years of related cybersecurity, RMF, security control assessment, or information assurance experience
• DoD IAM III required certification(s) (one of the following):