Lead Security Control Assessor - DoD RMF

Booz Allen Hamilton; Maryland; On-site; USD 99,000 - 225,000; Full time

Job summary

Booz Allen Hamilton is seeking a Lead Security Control Assessor to direct the SCA workstream for CDAO systems and environments, advising the AO on control effectiveness and risk. You will govern assessment strategy, evidence standards, and SAR/SAP reviews.

Your role includes developing and governing RMF guidance, test procedures, and BOE documentation, while mentoring assessors and coordinating with stakeholders across the organization.

Qualifications

• 8+ years of experience with cybersecurity including substantial DoD or federal RMF, security assessment, security engineering, or authorization
• Experience with eMASS, analyzing STIG, SCAP, ACAS findings, POA&Ms, architecture, inherited controls, compensating controls, and technical evidence
• Experience leading security control assessments and producing or approving SSPs, SAPs, SARs, POA&Ms, risk assessments, and authorization packages
• Experience with administration of Windows, Linux, AWS Cloud, and containerization systems and software configuration
• Experience with technical writing, facilitation, quality-assurance, team leadership, and stakeholder-management capabilities
• Knowledge of NIST SP 800-53, NIST SP 800-37, DoD RMF, STIGs, vulnerability management, and security-control assessment methodology
• Ability to evaluate complex enterprises, cloud, hybrid, containerized, data, and AI-enabled architectures and communicate risks at the AO and executive levels
• Ability to lead cybersecurity testing events including automated scanning tools, manual STIGs/SRGs, and remediation tracking

Responsibilities

• Provide eMASS administration, analyze STIG, SCAP, ACAS findings, POA&Ms, architecture, inherited controls, compensating controls, and technical evidence
• Work with the project ISSM to understand customer RMF requirements for systems
• Lead independent security control assessments per RMF, NIST guidance, and DoD policy
• Brief findings and risk recommendations to the ISSM, AO, and stakeholders
• Develop RMF BOE documentation and input into AO databases (eMASS, SharePoint)
• Review and approve SAPs and SARs for technical accuracy and defensibility
• Coordinate with system owners, ISSMs/ISSOs, engineers, admins, leaders, and AO reps
• Review system boundaries, data flows, interfaces, and significant changes
• Oversee assessment execution for ATO, reauthorization, annual review, changes, and continuous monitoring
• Brief status, risks, remediation, and authorization recommendations to senior stakeholders
• Mentor assessors and ensure independence across the lifecycle
• Develop relationships with stakeholders across the organization
• You Have: 8+ years in cybersecurity including DoD/federal RMF and authorization

Skills

DoD RMF

Security assessment

Lead/mentoring

eMASS administration

STIG/SCAP/ACAS

Education

Bachelor's degree in Engineering or Cyber

Tools

eMASS

Windows

Linux

AWS Cloud

Containerization

Job description

Booz Allen Hamilton is seeking a Lead Security Control Assessor to direct the SCA workstream for CDAO systems and environments, advising the AO on control effectiveness and risk. You will govern assessment strategy, evidence standards, and SAR/SAP reviews.

Your role includes developing and governing RMF guidance, test procedures, and BOE documentation, while mentoring assessors and coordinating with stakeholders across the organization.