Security Control Assessor Representative

Insight Global; St. Louis (MO); On-site; USD 120,000 - 150,000; Full time

Job summary

Insight Global is seeking an experienced Secret Security Control Assessor Representative (SCAR) to support a large DoD cybersecurity program at Scott Air Force Base. The SCAR will independently assess security controls, validate RMF compliance, and support ATO decisions for enterprise systems critical to DoD missions.

The role requires 6–8+ years in cybersecurity/RMF, extensive eMASS experience, and strong knowledge of RMF processes and DoD documentation such as SSPs and POA&Ms.

Qualifications

• 6–8+ years in cybersecurity, information assurance, or RMF.
• Strong RMF experience with DoD requirements.
• Experience reviewing SSPs, POA&Ms, RMF Packages and Authorization Packages (Rev4 & Rev5).
• Ability to identify cybersecurity risks and control deficiencies.
• Certifications (One Required) such as CISSP/CISM/CISA/GSLC/GSNA.

Responsibilities

• Conduct independent security control assessments across management, operational, technical, and privacy controls.
• Review RMF documentation (SSPs, POA&Ms, Security Categorization Packages, Authorization Packages).
• Assess artifacts and identify cybersecurity risks, gaps, and deficiencies.
• Perform IV&V activities in eMASS to verify controls operate as intended.
• Provide risk-based recommendations and support AO/ SCA package preparation.
• Coordinate authorization package status from submission to approval/denial.
• Collaborate with system owners, ISSOs, cybersecurity teams, and government stakeholders.

Skills

RMF knowledge

eMASS proficiency

Security control assessments

Documentation review

Risk analysis

Stakeholder collaboration

Education

CISSP

CISSP-ISSEP

CISM

CISA

CCISO

CySA+

GSLC

GSNA

Tools

eMASS

Job description

A client is seeking an experienced Secret Security Control Assessor Representative (SCAR) to support a large Department of Defense cybersecurity program at Scott Air Force Base. This individual will serve as an independent cybersecurity assessor responsible for evaluating security controls, validating RMF compliance, and supporting authorization decisions for enterprise systems supporting critical DoD missions.

This position functions as a cybersecurity auditor and risk assessor, reviewing documentation, security controls, and authorization packages to determine whether systems are secure, compliant with DoD requirements, and capable of receiving Authorization to Operate (ATO) approval.

The SCAR will support more than 40 Programs of Record across the enterprise and act as a trusted advisor to the Security Control Assessor (SCA) and Authorizing Official (AO) by providing risk-based recommendations and independent assessments.

Key Responsibilities

• Conduct independent security control assessments to evaluate the effectiveness of management, operational, technical, and privacy controls.
• Review RMF documentation including:
• System Security Plans (SSPs)
• Plans of Action & Milestones (POA&Ms)
• Security Categorization Packages
• Authorization Packages
• Risk Acceptance Requests
• Assess security artifacts and identify cybersecurity risks, compliance gaps, and control deficiencies.
• Perform Independent Verification & Validation (IV&V) activities within eMASS to ensure controls are:
• Implemented correctly
• Operating as intended
• Producing desired security outcomes
• Provide recommendations for risk acceptance, remediation activities, and authorization decisions.
• Support Security Control Assessor (SCA) activities and Authorizing Official (AO) package preparation.
• Compile and coordinate authorization packages and required approval documentation for leadership review.
• Review and triage RMF submissions using Government Artifact Quality Rubrics.
• Document deficiencies through Package Return Reports (PRRs) and coordinate corrective actions.
• Support risk analysis efforts and provide technical recommendations to government stakeholders.
• Track authorization package status from submission through approval or denial.
• Maintain cybersecurity compliance records and authorization documentation.
• Manage eMASS user accounts and permissions as directed.
• Provide subject matter expertise on RMF processes, cybersecurity controls, and DoD compliance requirements.
• Collaborate with system owners, ISSOs, cybersecurity teams, and government stakeholders to ensure successful system authorizations.

Must Haves:

• 6-8+ years of cybersecurity, information assurance, or RMF experience
• Strong experience with the DoD Risk Management Framework (RMF)
• Extensive hands‑on experience with eMASS
• Experience reviewing and assessing:
• SSPs
• POA&Ms
• RMF Packages
• Authorization Packages (Rev4 & Rev5)
• Security Control Assessments
• Experience identifying cybersecurity risks and security control deficiencies
• Certifications (One Required)
• CISSP
• CISSP-ISSEP
• CISM
• CISA
• CCISO
• CySA+
• GSLC
• GSNA

Plusses:

• Previous Security Control Assessor Representative (SCAR/SCA-R) experience
• Direct DoD cybersecurity assessment experience
• Information System Security Officer (ISSO) background
• Experience supporting USTRANSCOM or other DoD organizations
• Ports, Protocols & Services Management (PPSM) experience
• Experience supporting NIPRNet and SIPRNet environments