Security Control Assessor II

Jobtailor; Bedford (MA); On-site; USD 120,000 - 170,000; Full time

Job summary

Jobtailor seeks an experienced ISSO/ISSM to lead security assessments for information systems in a government-oriented environment. The role focuses on RMF-based evaluations, vulnerability analysis, and authorization activities across SAP, SCI, and collateral information systems.

The candidate will advise senior officials and coordinate with ISO/DAO/AO, supporting SDLC compliance. Required are 7+ years of related experience, a TS/SCI clearance, and relevant IA certifications.

Qualifications

• Bachelor’s degree in a related discipline; or Associate’s degree in a related area with 2 years’ experience; or equivalent experience (4 years).
• Information Assurance Technician Level III or Information Assurance Manager Level II certification.
• Top Secret/SCI clearance required to start; CI polygraph may be required.
• US Citizenship required.
• Must be willing to sit for a CI polygraph.

Responsibilities

• Conduct comprehensive assessments of management, operational, and technical security controls within or inherited by information systems.
• Assess control effectiveness and severity of identified weaknesses or deficiencies.
• Recommend corrective actions for identified vulnerabilities.
• Cover Collateral, SCI, and SAP activities within the customer’s area of responsibility.
• Oversee development, implementation, and evaluation of IS security program policy, including SAP network infrastructure integration.
• Assess information systems using RMF methodology in accordance with JSIG.
• Advise the ISO, IDO, PSO, DAO/AO on assessment and authorization issues.
• Evaluate authorization packages and recommend authorization decisions.
• Evaluate system threats and vulnerabilities and determine required safeguards.
• Advise the Government on confidentiality, integrity, and availability impact levels.
• Complete and document security assessments and prepare Security Assessment Reports.
• Initiate POA&Ms for identified weaknesses.
• Evaluate assessment documentation and provide written authorization recommendations.
• Submit security authorization packages to the AO/DAO.
• Assess proposed changes to authorization boundaries, operating environments, and mission needs.
• Review and concur with sanitization and clearing procedures.
• Assist with Government compliance inspections and cybersecurity security incidents.
• Ensure organizations address all phases of the SDLC.
• Evaluate hardware and software security impacts on authorization boundaries.
• Evaluate continuous monitoring plan effectiveness and implementation.
• Represent the customer on inspection teams.

Skills

RMF Methodology

Security Assessments

Vulnerability Assessment

Security Policy Development

Continuous Monitoring

System Authorization

Risk Management

Education

Bachelor’s degree in a related discipline

Associate’s degree in a related area + 2 years’ experience

Equivalent experience (4 years)

Tools

JSIG

NIST RMF

Job description

• Conduct comprehensive assessments of management, operational, and technical security controls within or inherited by information systems
• Assess control effectiveness and severity of identified weaknesses or deficiencies
• Recommend corrective actions for identified vulnerabilities
• Cover Collateral, SCI, and SAP activities within the customer’s area of responsibility
• Oversee development, implementation, and evaluation of IS security program policy, including SAP network infrastructure integration
• Assess information systems using RMF methodology in accordance with JSIG
• Advise the ISO, IDO, PSO, DAO/AO on assessment and authorization issues
• Evaluate authorization packages and recommend authorization decisions
• Evaluate system threats and vulnerabilities and determine required safeguards
• Advise the Government on confidentiality, integrity, and availability impact levels
• Complete and document security assessments and prepare Security Assessment Reports
• Initiate POA&Ms for identified weaknesses
• Evaluate assessment documentation and provide written authorization recommendations
• Submit security authorization packages to the AO/DAO
• Assess proposed changes to authorization boundaries, operating environments, and mission needs
• Review and concur with sanitization and clearing procedures
• Assist with Government compliance inspections and cybersecurity security incidents
• Ensure organizations address all phases of the SDLC
• Evaluate hardware and software security impacts on authorization boundaries
• Evaluate continuous monitoring plan effectiveness and implementation
• Represent the customer on inspection teams

Requirements

• 7+ years of related experience
• Prior performance in the role of ISSO and ISSM or SCA
• Minimum of four (4) years’ experience in SAP, SCI or Collateral Information Systems (IS) Security and implementation of applicable regulations
• Bachelor’s degree in a related discipline OR Associate’s degree in a related area + 2 years’ experience OR equivalent experience (4 years)
• Information Assurance Technician Level III or Information Assurance Manager Level II certification
• Top Secret/SCI clearance required to start
• Must be willing to sit for a CI polygraph
• US Citizenship required
• Skills in Computer Security, Information Assurance, Information Security, and Information Security Management
• 40 scheduled weekly hours
• 10–25% travel required

Core Competencies

Demonstrates expertise in conducting security assessments and evaluating information systems using RMF methodology, with a strong focus on compliance and risk management. Proficient in developing and implementing security policies, and providing recommendations for vulnerabilities in SAP, SCI, and Collateral Information Systems.

Highest-signal resume keywords

• Information Security Management
• Risk Management Framework (RMF)
• Security Assessment Reports
• Information Assurance Technician Level III
• Top Secret/SCI Clearance

ATS Optimization Keywords

Hard Skills

• Security Assessments
• Vulnerability Assessment
• Control Effectiveness Evaluation
• Security Program Policy Development
• Authorization Package Evaluation
• Continuous Monitoring Plan Evaluation
• System Threat Evaluation
• Sanitization Procedures Review
• Cybersecurity Incident Response
• SDLC Compliance

Certifications & Qualifications

• Information Assurance Technician Level III
• Information Assurance Manager Level II

Industry Keywords

• Collateral Information Systems
• Sensitive Compartmented Information (SCI)
• Special Access Program (SAP)
• Confidentiality
• Integrity
• Availability
• POA&Ms
• Government Compliance Inspections
• Cybersecurity
• Top Secret Clearance