Security Control Assessor

Pueo Business Solutions LLC; Virginia (MN); On-site; USD 120,000 - 190,000; Full time

Job summary

Pueo is seeking a Security Control Assessor (SCA) to conduct comprehensive assessments of security controls within information systems, determine effectiveness, and prepare the Body of Evidence (BoE) including SSP, SAR, POA&M, and a draft ATO letter for AO/DAO review.

The SCA will engage with program offices, ISSOs, data owners, and authorizing officials to guide RMF categorization and assign confidentiality, integrity, and availability impact levels.

Qualifications

• Bachelor's degree or 16 years related experience in cybersecurity.
• Twelve (12) years of experience in cybersecurity RMF and A&A activities.
• IAT Level III certification per DoD 8570.01-M and DoD Directive 8140 Cyberspace Workforce Management requirements.
• Certifications include: CASP+ CE, CCNP Security, CISA, CISSP or CISSP Associate, GCED, GCIH, CCSP.

Responsibilities

• Conduct comprehensive assessments of security controls and determine their effectiveness and compliance.
• Develop and submit the complete BoE, including SSP, SAR, POA&M, and draft ATO letter for AO/DAO review.
• Advise stakeholders on RMF categorization and determining confidentiality, integrity, and availability impact levels.

Skills

Interpersonal communication

Vulnerability tools

Team collaboration

Education

Bachelor's degree in Cybersecurity/CS/IT

16 years related experience

Tools

Xacta

STIG Viewer

ACAS

Prisma

Splunk

Trellix HBSS

Vulnerability Scanners

Job description

Description

The Security Control Assessor (SCA) conducts comprehensive assessments of security controls employed by, or inherited within, information systems to determine their overall effectiveness and compliance with applicable security requirements. The SCA develops and submits the complete Body of Evidence (BoE), including the System Security Plan (SSP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), and draft Authorization to Operate (ATO) letter, to the Authorizing Official (AO) or Delegated Authorizing Official (DAO) for review and authorization determination.

The SCA serves as a trusted advisor to key stakeholders, including Program Offices, Data Owners, Information System Security Officers (ISSOs), and Authorizing Officials/Delegated Authorizing Officials, providing guidance on system security categorization and determining appropriate confidentiality, integrity, and availability impact levels in accordance with Risk Management Framework (RMF) requirements.

Knowledge, Skills and Abilities

• Excellent interpersonal, verbal, and written communication skills, with experience collaborating across mixed technical teams and engaging diverse stakeholders.
• Expert-level experience reviewing, analyzing, and interpreting compliance and vulnerability assessment results from tools such as Xacta, STIG Viewer, ACAS, Prisma, Splunk, Trellix (HBSS), and other vulnerability scanners.
• Ability to lead or support security projects and initiatives, manage competing priorities, and contribute effectively in a team-oriented environment.

Required Qualifications:

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field. A Bachelor’s degree may be substituted with an additional four (4) years of directly related experience, for a total of sixteen (16) years of relevant experience.
• Twelve (12) years of experience supporting cybersecurity, Information Assurance, Risk Management Framework (RMF), and Assessment & Authorization (A&A) activities.
• Obtain and maintain an IAT Level III certification in accordance with DoD 8570.01-M and DoD Directive 8140 Cyberspace Workforce Management requirements.
• Acceptable certifications include: CompTIA Advanced Security Practitioner (CASP+ CE), Cisco Certified Network Professional Security (CCNP Security), Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP) or CISSP Associate, GIAC Certified Enterprise Defender (GCED), GIAC Certified Incident Handler (GCIH), and Certified Cloud Security Professional (CCSP).

Clearance:

• Hold a Top Secret Security Clearance with SCI eligibility. Ability to Pass CI Poly.

Pueo is an equal employment opportunity employer and affirmative action employer. All interested individuals will receive consideration and will not be discriminated against on the basis of race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity, genetic information, or protected veteran status. Pueo takes affirmative action in support of its policy to advance diversity and inclusion of individuals who are minorities, women, protected veterans, and individuals with disabilities.