Security Control Assessor I - RMF/SAP Specialist

General Dynamics Information Technology, Inc.; Town of Stockbridge (WI); On-site; USD 130,000 - 157,000; Full time

Benefits offered by this job

401K match

Health and wellness packages

Internal mobility support

Education and certifications

Cutting-edge technology

Extra vacation

Job summary

General Dynamics Information Technology, Inc. is seeking a Security Control Assessor I to conduct comprehensive RMF-based security control assessments for SAP/SCI environments.

The role analyzes management, operational, and technical controls, documents findings, and coordinates with ISO/IDO/PSO/DAO to support authorization decisions. Responsibilities include evaluating risk, preparing SARs, developing POA&Ms, and advising government stakeholders on security posture and authorization packages.

Qualifications

• 5+ years of related experience
• Minimum of three (3) years’ experience in SAP, SCI or Collateral Information Systems (IS) Security and the implementation of regulations identified in the description of duties.
• Prior performance in the role of ISSO and ISSM.

Responsibilities

• Perform oversight of the development, implementation and evaluation of IS security program policy; special emphasis placed upon integration of existing SAP network infrastructure.
• Perform assessment of ISs, based upon the Risk Management Framework (RMF) methodology in accordance with the Joint Special Access Program (SAP) Implementation Guide (JSIG)
• Advise the Information System Owner (ISO), Information Data Owner (IDO), Program Security Officer (PSO), and the Delegated and/or Authorizing Official (DAO/AO) on any assessment and authorization issues.
• Evaluate Authorization packages and make recommendation to the AO and/or DAO for authorization.
• Evaluate IS threats and vulnerabilities to determine whether additional safeguards are required.
• Advise the Government concerning the impact levels for Confidentiality, Integrity, and Availability for the information on a system.
• Ensure security assessments are completed and results documented and prepare the Security Assessment Report (SAR) for the Authorization boundary.
• Initiate a Plan of Action and Milestones (POA&M) with identified weaknesses for each.
• Authorization Boundaries assessed, based on findings and recommendations from the SAR.
• Evaluate security assessment documentation and provide written recommendations for security authorization to the Government.
• Discuss recommendation for authorization and submit the security authorization package to the AO/DAO.
• Assess proposed changes to Authorization boundaries operating environment and mission needs to determine the continuation to operate.
• Review and concur with all sanitizations and clearing procedures in accordance with Government guidance and/or policy.
• Assist the Government compliance inspections.
• Assist the Government with security incidents that relate to cybersecurity and ensure that the proper and corrective measures have been taken.
• Ensure organization are addressing and conducting all phases of the system development life cycle (SDLC)
• Evaluate Hardware and Software to determine security impact that it might have on Authorization boundaries.
• Evaluate the effectiveness and implementation of Continuous Monitoring Plans.
• Represent the customer on inspection teams.

Skills

Information Security

Information Systems

Risk Mitigation Strategies

System Security

Education

Bachelor's degree in a related discipline

Associate’s degree in a related area + 2 years’ experience

Equivalent experience (4 years)

Job description

General Dynamics Information Technology, Inc. is seeking a Security Control Assessor I to conduct comprehensive RMF-based security control assessments for SAP/SCI environments.

The role analyzes management, operational, and technical controls, documents findings, and coordinates with ISO/IDO/PSO/DAO to support authorization decisions. Responsibilities include evaluating risk, preparing SARs, developing POA&Ms, and advising government stakeholders on security posture and authorization packages.