Security Control Assessor (SCA) - Level II

Rividium; Washington (District of Columbia); On-site; USD 150,000 - 190,000; Full time

Job summary

RiVidium is seeking a Security Control Assessor (SCA) Level II to lead complex A&A activities for DHS Intelligence Enterprise across TS/SCI environments. You will assess security controls, prepare SARs, and guide remediation efforts while collaborating with ISSOs, AOs, and CISO leadership.

Ideal candidates have TS/SCI clearance with SAP eligibility, 10+ years in information security/A&A, and strong RMF/NIST expertise.

Qualifications

• Active TS/SCI clearance with SAP eligibility.
• Minimum 10 years of information security/A&A experience.
• Familiarity with FISMA, RMF, and IC cybersecurity policy.
• Current CISM, CAP, or GRC certification is required or preferred.
• Strong knowledge of NIST RMF, SP 800-37/53/53A and CNSSI 1253.

Responsibilities

• Lead A&A activities for DHS IE systems across TS/SCI, Secret, and Unclassified.
• Assess security controls and document SARs and GRC artifacts.
• Identify deficiencies and provide technical remediation recommendations.
• Coordinate POA&Ms, track remediation, and support authorization decisions.
• Develop A&A packages: ATO/ATC/IATT, SARs, SAPs, and risk memos.

Skills

A&A leadership

RMF knowledge

Security controls

GRC tooling

Education

Bachelor's degree in Cybersecurity / CS / IS / IA

Tools

RSA Archer

Nessus

Nmap

WebInspect

SonarQube

Job description

Security Control Assessor (SCA) Level II

Full-Time/Part-Time Full-Time

Description

The Security Control Assessor (SCA) - Level II serves as a senior technical authority responsible for leading Assessment and Authorization (A&A) activities across the Department of Homeland Security (DHS) Intelligence Enterprise (DHS IE). This position conducts comprehensive security control assessments for classified and unclassified information systems, cloud environments, Cross Domain Solutions (CDS), and C-LAN extension sites in support of the NIST Risk Management Framework (RMF) and DHS/Intelligence Community (IC) cybersecurity requirements.

The Security Control Assessor provides expert guidance on security control implementation, risk management, continuous monitoring, and authorization package development while working closely with System Owners, Information System Security Officers (ISSOs), Information System Security Managers (ISSMs), Security Engineers, Government Authorizing Officials (AOs), Security Control Assessor Representatives (SCARs), Branch Chiefs, and the DHS I&A Chief Information Security Officer (CISO). The successful candidate will possess extensive experience leading complex A&A efforts for enterprise systems operating in classified, hybrid, cloud, and Cross Domain Solution environments.

Key Responsibilities

• Lead comprehensive Assessment and Authorization (A&A) activities for DHS Intelligence Enterprise information systems operating in Top Secret/Sensitive Compartmented Information (TS/SCI), Secret, and Unclassified environments.
• Conduct security assessments for enterprise systems hosted in:
  • On-premises data centers
  • DHS DICE
  • Commercial Cloud Enterprise (C2E)
  • Intelligence Community (IC) Cloud
  • AWS GovCloud
  • Hybrid cloud environments
  • Cross Domain Solution (CDS) environments
  • CONUS and OCONUS C-LAN extension sites
• Lead project discovery sessions, kickoff meetings, and stakeholder engagements for new system authorizations, reauthorizations, and major system changes.
• Assess the implementation and effectiveness of NIST security controls and document findings within the Security Assessment Report (SAR) and Governance, Risk, and Compliance (GRC) platform.
• Identify security control deficiencies, vulnerabilities, and compliance gaps; provide technical recommendations to reduce organizational risk.
• Validate the accuracy and completeness of Plans of Action and Milestones (POA&Ms), ensuring corrective actions align with identified assessment findings.
• Monitor remediation activities and verify completion of corrective actions before recommending authorization decisions.
• Develop and prepare complete Authorization and Assessment packages, including:
  • Authorization to Operate (ATO)
  • Authorization to Connect (ATC)
  • Interim Authorization to Test (IATT)
  • Security Assessment Reports (SARs)
  • Risk Recommendation Memoranda
  • Risk Management Matrices
  • Security Assessment Plans (SAPs)
  • Project kickoff memoranda
  • System Owner acknowledgment letters
• Conduct technical reviews of System Security Plans (SSPs), Contingency Plans, Configuration Management Plans, and supporting RMF documentation.
• Maintain and update Assessment and Authorization Standard Operating Procedures (SOPs) for all DHS I&A enclaves, ensuring annual review and compliance with evolving Federal and Intelligence Community requirements.
• Participate in Office of Inspector General (OIG), Federal Information Security Modernization Act (FISMA), and Intelligence Community Oversight Program (ICOP) audits, inspections, and cybersecurity assessments.
• Represent the program during DHS and Intelligence Community cybersecurity working groups and technical review boards.
• Maintain enterprise A&A Project Portfolio Listing Reports and Quarterly A&A Assignment Reports.
• Research emerging technologies, cybersecurity standards, and automation opportunities to improve A&A efficiency and support ongoing authorization initiatives.
• Prepare executive briefings, risk summaries, technical presentations, and decision support materials for the DHS I&A CISO, Government leadership, and Authorizing Officials.
• Mentor junior cybersecurity personnel and provide technical guidance on RMF implementation, security control assessments, and authorization processes.

Minimum Qualifications

• Active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance with SAP eligibility.
• Minimum 10 years of experience in information security, cybersecurity risk management, or Assessment and Authorization (A&A), including demonstrated experience in:
  • Assessment and Authorization (A&A)
  • Federal Information Security Modernization Act (FISMA) compliance
  • Intelligence Community cybersecurity policy
  • Continuous Monitoring (ConMon)
  • Cross Domain Solutions (CDS)
  • Secure cloud and hybrid cloud environments
• Current Certified Information Security Manager (CISM), Certified Authorization Professional (CAP), or comparable Governance, Risk, and Compliance (GRC) certification.
• Certified Information Systems Security Professional (CISSP) certification is highly desirable.
• Expert knowledge of:
  • NIST Risk Management Framework (RMF)
  • NIST SP 800-37
  • NIST SP 800-53
  • NIST SP 800-53A
  • CNSSI 1253
  • ICD 503
  • DHS Sensitive Systems Policy Directive 4300C
  • Intelligence Community security overlays and authorization requirements
• Experience using Governance, Risk, and Compliance (GRC) platforms such as RSA Archer.
• Experience using security assessment and vulnerability management tools, including:
  • Nessus
  • SCAP
  • Nmap
  • WebInspect
  • SonarQube
  • Comparable security assessment tools
• Demonstrated experience leading A&A activities for Cross Domain Solutions (CDS), classified information systems, and cloud-based environments.
• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Assurance, or a related technical discipline.

Preferred Qualifications

• AWS Certified Security - Specialty, Microsoft Certified: Azure Security Engineer Associate, Google Professional Cloud Security Engineer, or equivalent cloud security certification.
• Experience supporting DHS Intelligence & Analysis (I&A) or other Intelligence Community cybersecurity organizations.
• Experience conducting Assessment and Authorization activities for OCONUS locations and C-LAN authorization extension sites.
• Experience supporting National Cross Domain Strategy and Management Office (NCDSMO) accreditation requirements and Raise the Bar (RTB) initiatives.
• Experience implementing Continuous Authorization (cATO), Agile RMF, or automated security assessment processes.
• Knowledge of DevSecOps security controls, Infrastructure as Code (IaC), and cloud-native security assessment methodologies.

Required Certifications

One of the following current certifications is required:

• Certified Information Security Manager (CISM)
• Certified Authorization Professional (CAP)
• Governance, Risk, and Compliance (GRC) Certification

Preferred certifications include:

• Certified Information Systems Security Professional (CISSP)
• AWS Certified Security - Specialty
• Microsoft Certified: Azure Security Engineer Associate
• Google Professional Cloud Security Engineer

Clearance Requirement

Active Top Secret/Sensitive Compartmented Information (TS/SCI) Clearance Required
SAP Eligibility Required

About the Organization Established in 2008, RiVidium, Inc. (dba TripleCyber) is a VA-Verified SDVOSB and an SBA-Certified 8(a) company. To prepare our clients for the future, RiVidium has balanced all parts of our organization to attract the finest employees in order to 'Strive to be the missing element defining tomorrow's technology'. RiVidium keeps pace and surpasses its competitors by meeting challenges of advancements in Logistics, Human Capital, Cyber, Intelligence & Technology.

EOE Statement We are an equal employment opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability status, protected veteran status or any other characteristic protected by law. If you need a reasonable accommodation for any part of the employment process, please contact Human Resources (HR) at [e-mail].

This position is currently accepting applications.

Follow us