Security Controls Assessor (SCA) Representative

KBR, Inc; Colorado Springs, Northern (CO, KY); Hybrid; USD 160,000 - 180,000; Full time

Job summary

KBR, Inc in Colorado Springs, CO seeks a Security Controls Assessor (SCA) Representative to support RMF/CSF compliance for advanced aerospace systems. You will conduct independent assessments of security controls and support A&A for US Space Force programs.

Requirements include TS/SCI with SAP/SAR eligibility, travel up to 50%, strong RMF/CSF knowledge, CISSP, and experience producing BoE artifacts and risk documentation within a DevSecOps/CI/CD environment.

Qualifications

• Active TS/SCI with SAP/SAR eligibility (US citizen).
• Experience as SAP SCA or SAP SCA Representative.
• Willingness to travel 20–50%.
• 5 years Linux implementation/principles/administration.
• Strong RMF/CSF knowledge and related documen­tation.
• Ability to perform cybersecurity assessments and develop risk plans.
• BoE artifacts (POA&M, cybersecurity plans) documentation ability.
• Demonstrated mitigations for varied cybersecurity challenges.
• Technical proficiency in multiple security domains (e.g., networks, embedded systems).
• Strong written and oral communication skills.
• Experience integrating security in DevSecOps/CI/CD.
• CISSP certification.

Responsibilities

• Conduct independent assessments of security controls to determine effectiveness.
• Apply RMF/CSF to integrated weapon systems.
• Perform A&A events and support SAP/SAR AO recommendations.
• Develop Security Assessment Report to support Authorization to Operate decisions.
• Travel up to 20–50% for USSF engagements.

Skills

SAP SCA experience

Travel readiness

Linux

RMF/CSF knowledge

Cybersecurity assessments

BoE artifacts

Mitigation strategies

Security domains knowledge

DevSecOps

Communication skills

CISSP

Education

Bachelor's or Master's degree in related discipline

Job description

Security Controls Assessor (SCA) RepresentativeKBR is seeking a Security Controls Assessor (SCA) Representative in Colorado Springs, CO area. The individual will directly support the United States Space Force (USSF) Risk Management Framework, Cybersecurity Framework (RMF, CSF) compliance activities to ensure security controls are defined, implemented, and assessed for complex multi-level security architectures of advanced aerospace systems.**Key Responsibilities:*** Conducts independent comprehensive assessments of the management, operational, and technical security controls, and control enhancements implementation within or inherited by an information technology (IT) system to determine the overall effectiveness of the controls (as defined in NIST SP 800-37).* Applies RMF/CSF principles to the development of integrated weapon systems.* Conducts assessment and authorization (A&A) events to support recommendations to the USSF Special Access Program/Special Access Required (SAP/SAR) Authorizing Official (USSF SAP AO) based on requirements, security impact levels and projected/current operational environment.* Develops Security Assessment Report to support Authorization to Operate decisions.* Full-time job with frequent US travel required.**Qualifications:****Required:*** An active TS/SCI and eligible for SAP/SAR, which is something only a U.S. citizen can obtain.* Prior experience as a SAP SCA or SAP SCA Representative.* Ability to travel 20%-50%.* 5 years of Linux experience in implementation/principles/administration.* Strong knowledge of RMF/CSF process activities and related documentation (e.g., life-cycle support plans, concept of operations, and operational procedures) to confirm the level of risk is within acceptable limits.* Demonstrated ability perform cybersecurity assessments, identify gaps in cybersecurity architecture, and develop a security risk management plan that articulates risk to both technical and non-technical audiences.* Ability to ensure Body of Evidence (BoE) artifacts such as plans of actions and milestones and cybersecurity plans are in place for vulnerabilities/deficiencies identified during risk assessments, audits, inspections, etc.* Demonstrated history finding unique mitigations to varied systems’ cybersecurity challenges to assess the effectiveness of security controls.* Demonstrated technical proficiency in at least two of the following areas of security: communications, networks, embedded systems, software, system testing or assessment, etc.* Strong written and oral communication skills to support necessary compliance activities (e.g., ensure that system security configuration guidelines are followed, compliance monitoring occurs).* Ability to verify software/network/system security postures are implemented within a DevSecOps process, agile methodology and continuous integration/continuous delivery (CI/CD) pipeline to ensure cybersecurity requirements are included in early during development.* Demonstrated ability to develop methods to develop methods to monitor and measure risk, compliance, and information assurance efforts.* Certified Information System Security Professional (CISSP).**Desired Qualifications:*** Bachelors or Masters degree in related discipline.* Certified Cloud Security Professional (CCSP).* Certified Ethical Hacker (CEH).* AWS or other cloud technology security certification.**Scheduled Weekly Hours:**40hrs**Work Environment:*** **Location:** On-site* **Travel Requirements:** Up to 20-50%* **Working Hours:** Standard**Basic Compensation:**$160,000 - $180,000