Senior RMF Security Controls Lead

Strategic Analysis, Inc.; Arlington (VA); On-site; USD 120,000 - 180,000; Full time

Job summary

Strategic Analysis, Inc. seeks an experienced Senior Security Control Assessor (SCA) to support RMF activities, including assessment, authorization, and continuous monitoring of DoD/IC information systems. You will evaluate security controls, identify risks, and support authorization decisions.

Responsibilities include assessing control effectiveness, conducting risk analysis, and delivering mitigation recommendations. Travel up to 50% and active TS/SCI w/ CI Poly are required.

Qualifications

• 7+ years of cybersecurity experience supporting RMF/A&A activities.
• Experience supporting SAP environments within DoD/IC.
• Background in SCA, ISSM, ISSO, or ISSE roles.
• Strong knowledge of RMF, NIST frameworks, and secure cloud/AI/ML environments.
• Experience with GRC/RMF tools such as XACTA, eMASS, or ServiceNow (SNOW).
• Bachelor's degree or higher in a relevant field.
• Active TS/SCI clearance with CI poly.

Responsibilities

• Assess the effectiveness of security controls in RMF
• Perform security reviews to identify gaps in system architecture and design
• Conduct risk analysis and develop mitigation recommendations
• Execute security authorization reviews and support ATO decisions
• Validate security posture of systems, networks, and applications
• Monitor and evaluate compliance across information systems
• Develop Statements of Risk (SORs) and document security findings
• Provide authorization recommendations to the Authorizing Official

Skills

SCA experience

RMF/A&A

Vulnerability analysis

Risk assessment

Education

Bachelor's degree or higher

IAM Level III certification (CISM, CISSP, GSLC)

Tools

XACTA

eMASS

ServiceNow (SNOW)

SAP environments

Job description

Strategic Analysis, Inc. seeks an experienced Senior Security Control Assessor (SCA) to support RMF activities, including assessment, authorization, and continuous monitoring of DoD/IC information systems. You will evaluate security controls, identify risks, and support authorization decisions.

Responsibilities include assessing control effectiveness, conducting risk analysis, and delivering mitigation recommendations. Travel up to 50% and active TS/SCI w/ CI Poly are required.