Senior Security Control Assessor Representative (SCAR)

Dark Wolf Solutions, LLC; United States; Hybrid; USD 140,000 - 145,000; Full time

Job summary

Dark Wolf Solutions is seeking a Senior Security Control Assessor Representative (SCAR) to conduct independent assessments of IT security controls, control enhancements, and related artifacts to determine overall effectiveness for system authorizations. The SCAR will review technical and functional adequacy to support authorization decisions.

The position requires DoD RMF/CSF experience, cloud security knowledge, and experience with eMASS or XACTA.

Qualifications

• 15+ years of relevant cyber experience.
• 15+ years as SCAR/RMF engineer/ISSO/ISSM or IA engineer.
• Cloud platform experience (AWS, Azure, or Google GCP).
• Hands-on eMASS and/or XACTA experience.
• Experience with DoD risk management policies (DODI 8510.01, AFI 17-101).
• Experience with Cloud Computing Security Requirements Guide (CC SRG).
• Knowledge of DoD DevSecOps Fundamentals Playbook.
• Experience evaluating information security compliance against STIGs.
• Clear articulation of ideas; strong technical writing for reports to AO/CISO.
• US Citizenship and currently possess a Top Secret clearance.
• B.S. Information Security or related discipline.

Responsibilities

• Evaluate IT infrastructure for risk and define artifacts to meet DoD/AF requirements.
• Assess IT systems to ensure RMF/CSF/802.53 alignment.
• Support A&A efforts, guiding artifacts and activities per DoD/AF policies.
• Review business processes and validate mitigating controls.
• Review risk matrices and testing plans for key controls.
• Identify control gaps and test existing designs.
• Formulate conclusions on internal controls and process efficiency.
• Recommend policies to ensure reliability and prevent unauthorized access.
• Conduct risk and vulnerability assessments to identify vulnerabilities.
• Review POA&Ms and provide reports to SCA/AO/CISO.
• Ensure rigorous application of cybersecurity policies in IT services.

Skills

Cybersecurity experience

RMF/Assessor experience

Cloud platforms (AWS/Azure/GCP)

eMASS / XACTA

DoD policy knowledge (DODI 8510.01, AF

CC SRG knowledge

DevSecOps familiarity

Security certifications (CISSP/CISA/CN

US Citizenship & TS clearance

Education

B.S. Information Security or related field

Tools

eMASS

XACTA

JIRA

Confluence

SharePoint

Job description

Dark Wolf Solutions is seeking a Senior Security Control Assessor Representative (SCAR) to conduct independent comprehensive assessments of the management, operation, and technical security controls and control enhancements employed within, or inherited by, an Information technology (IT) system to determine the overall effectiveness of the controls. The SCAR will perform reviews of security artifacts for system authorizations, assessing both the technical and functional adequacy as required for application and software cybersecurity readiness. The SCAR candidate must have prior experience in authorizing tools/applications, systems, and/or enclaves. Additionally, knowledge of network security, technologies, processes, and practices designed for the prevention of damage to, protection of, and restoration of computers, communications systems, services, and various types of communications technologies. The SCAR candidate must be knowledgeable and proficient in assessing DoD GovCloud environments to include testing controls and validating artifacts. A successful candidate will have a strong foundational understanding of NIST, DOD, and DAF cybersecurity focused guidance. This position can be based out of any Dark Wolf Office location and will be a hybrid schedule. Additional responsibilities include:

Key Responsibilities:

• Evaluating IT infrastructure in terms of risk to the organization and defining artifacts required to meet Federal, DoD and DAF requirements
• Assessing IT systems and architecture to ensure compliance with the Risk Management Framework (RMF), NIST Cybersecurity Framework (CSF), NIST 800-53 revision 5 and applicable guidance
• Supporting the system/application assessment and authorization (A&A) effort, to include assessing and guiding the quality and completeness of A&A activities, tasks and resulting artifacts mandated by governing DoD and AF policies, and applicable mandates
• Collecting, reviewing and verifying documented business processes within process narratives or flowcharts, identifying risks and validating proficiency of mitigating controls
• Reviewing risk and control matrices and testing plans for key controls and determines effectiveness
• Identifying control gaps, reviewing and testing the design of existing controls.
• Formulating clear and concise conclusions on internal controls and business process efficiency
• Recommending policies and procedures to ensure information systems reliability and accessibility and to prevent and defend against unauthorized access to systems, networks, and data
• Conducting risk and vulnerability assessments of installed information systems to identify vulnerabilities, risks, and protection needs
• Reviewing Plans of Actions & Milestones (POA&Ms)
• Providing recommendations and reports to the Security Control Assessor (SCA), Authorizing Official (AO), Chief Information Security Officer (CISO)
• Reviewing network and systems design to ensure accuracy
• Ensuring the rigorous application of information security/cybersecurity policies, principles, and practices in the delivery of all IT services

Required Qualifications:

• 15+ years of relevant Cyber experience
• 15+ years prior experience as a Security Control Assessor/Representative RMF Engineer, ISSO, ISSM and/or information assurance engineer
• Cloud Platform experience with at least one service offering from AWS, Azure, or Google GCP
• Hands-on eMASS and/or Xacta experience completing full system lifecycle activities
• Experience with Air Force risk management policies/procedures, to include, DODI 8510.01, AFI 17-101
• Experience with Cloud Computing Security Requirements Guide (CC SRG)
• Knowledgeable with DoD DevSecOps Fundamentals Playbook
• Experience evaluating information security compliance against STIGs
• Ability to clearly articulate ideas
• Strong technical writing abilities to author reports for AO and CISO dissemination
• Exudes confidence in providing briefings, presentations, and in conducting/guiding meetings with senior leadership and stakeholders
• Ability to use prior experience and knowledge to address new situations
• Certification requirements (at least one of the following): SecurityX / CASP+, CCISO, CGRC/CAP, CISA, CISM, CISSO, CISSP, CISSP-ISSEP, Cloud+, CySA+, FITSP-A, GCSA, GSEC, GSLC, GSNA, PenTest+, Security+
• B.A. or B.S. Information Security, Computer Science or related discipline
• US Citizenship and currently possess a Top Secret security clearance

Desired Qualifications:

• Experience with Fast Track ATO Handbook & AF Continuous ATO Playbook
• Familiarity with CI/CD Pipelines
• DevSecOps experience
• Sharepoint, JIRA, Confluence familiarity

The salary range for this position is $140,000.00 - $145,000.00 commensurate on experience and technical skillset.

We are open to considering a variety of levels of experience for these projects and potential for 1099 hourly opportunity.

We are proud to be an EEO/AA Employer Minorities/Women/Veterans/Disabled and other protected categories.

In compliance with federal law, all persons hired will be required to verify identity, confirm US Citizenship, and complete the required employment eligibility verification upon hire.