Security Control Assessor (SCA) — Level II

RiVidium Inc. is seeking an experiencedSecurity Control Assessor (SCA) Level IIto serve theteam for allCybersecurity and Intelligence Enterprise Information Technology Services (CIEITS)program activities.

The Security Control Assessor (SCA) Level II serves as a senior technical authority responsible for leading Assessment and Authorization (A&A) activities across the Department of Homeland Security (DHS) Intelligence Enterprise (DHS IE). This position conducts comprehensive security control assessments for classified and unclassified information systems cloud environments Cross Domain Solutions (CDS) and C-LAN extension sites in support of the NIST Risk Management Framework (RMF) and DHS/Intelligence Community (IC) cybersecurity requirements.

The Security Control Assessor provides expert guidance on security control implementation risk management continuous monitoring and authorization package development while working closely with System Owners Information System Security Officers (ISSOs) Information System Security Managers (ISSMs) Security Engineers Government Authorizing Officials (AOs) Security Control Assessor Representatives (SCARs) Branch Chiefs and the DHS I&A Chief Information Security Officer (CISO). The successful candidate will possess extensive experience leading complex A&A efforts for enterprise systems operating in classified hybrid cloud and Cross Domain Solution environments.

Key Responsibilities

• Lead comprehensive Assessment and Authorization (A&A) activities for DHS Intelligence Enterprise information systems operating in Top Secret/Sensitive Compartmented Information (TS/SCI) Secret and Unclassified environments.
• Conduct security assessments for enterprise systems hosted in:
  • On-premises data centers
  • DHS DICE
  • Commercial Cloud Enterprise (C2E)
  • Intelligence Community (IC) Cloud
  • AWS GovCloud
  • Hybrid cloud environments
  • Cross Domain Solution (CDS) environments
  • CONUS and OCONUS C-LAN extension sites
• Lead project discovery sessions kickoff meetings and stakeholder engagements for new system authorizations reauthorizations and major system changes.
• Assess the implementation and effectiveness of NIST security controls and document findings within the Security Assessment Report (SAR) and Governance Risk and Compliance (GRC) platform.
• Identify security control deficiencies vulnerabilities and compliance gaps; provide technical recommendations to reduce organizational risk.
• Validate the accuracy and completeness of Plans of Action and Milestones (POA&Ms) ensuring corrective actions align with identified assessment findings.
• Monitor remediation activities and verify completion of corrective actions before recommending authorization decisions.
• Develop and prepare complete Authorization and Assessment packages including:
  • Authorization to Operate (ATO)
  • Authorization to Connect (ATC)
  • Interim Authorization to Test (IATT)
  • Security Assessment Reports (SARs)
  • Risk Recommendation Memoranda
  • Risk Management Matrices
  • Security Assessment Plans (SAPs)
  • Project kickoff memoranda
  • System Owner acknowledgment letters
• Conduct technical reviews of System Security Plans (SSPs) Contingency Plans Configuration Management Plans and supporting RMF documentation.
• Maintain and update Assessment and Authorization Standard Operating Procedures (SOPs) for all DHS I&A enclaves ensuring annual review and compliance with evolving Federal and Intelligence Community requirements.
• Participate in Office of Inspector General (OIG) Federal Information Security Modernization Act (FISMA) and Intelligence Community Oversight Program (ICOP) audits inspections and cybersecurity assessments.
• Represent the program during DHS and Intelligence Community cybersecurity working groups and technical review boards.
• Maintain enterprise A&A Project Portfolio Listing Reports and Quarterly A&A Assignment Reports.
• Research emerging technologies cybersecurity standards and automation opportunities to improve A&A efficiency and support ongoing authorization initiatives.
• Prepare executive briefings risk summaries technical presentations and decision support materials for the DHS I&A CISO Government leadership and Authorizing Officials.
• Mentor junior cybersecurity personnel and provide technical guidance on RMF implementation security control assessments and authorization processes.

Minimum Qualifications

• Active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance with SAP eligibility.
• Minimum 10 years of experience in information security cybersecurity risk management or Assessment and Authorization (A&A) including demonstrated experience in:
  • Assessment and Authorization (A&A)
  • Federal Information Security Modernization Act (FISMA) compliance
  • Intelligence Community cybersecurity policy
  • Continuous Monitoring (ConMon)
  • Cross Domain Solutions (CDS)
  • Secure cloud and hybrid cloud environments
• Current Certified Information Security Manager (CISM) Certified Authorization Professional (CAP) or comparable Governance Risk and Compliance (GRC) certification.
• Certified Information Systems Security Professional (CISSP) certification is highly desirable.
• Expert knowledge of:
  • NIST Risk Management Framework (RMF)
  • NIST SP 800-37
  • NIST SP 800-53
  • NIST SP 800-53A
  • CNSSI 1253
  • ICD 503
  • DHS Sensitive Systems Policy Directive 4300C
  • Intelligence Community security overlays and authorization requirements
• Experience using Governance Risk and Compliance (GRC) platforms such as RSA Archer.
• Experience using security assessment and vulnerability management tools including:
  • Nessus
  • SCAP
  • Nmap
  • WebInspect
  • SonarQube
  • Comparable security assessment tools
• Demonstrated experience leading A&A activities for Cross Domain Solutions (CDS) classified information systems and cloud-based environments.
• Bachelors degree in Cybersecurity Computer Science Information Systems Information Assurance or a related technical discipline.

Preferred Qualifications

• AWS Certified Security Specialty Microsoft Certified: Azure Security Engineer Associate Google Professional Cloud Security Engineer or equivalent cloud security certification.
• Experience supporting DHS Intelligence & Analysis (I&A) or other Intelligence Community cybersecurity organizations.
• Experience conducting Assessment and Authorization activities for OCONUS locations and C-LAN authorization extension sites.
• Experience supporting National Cross Domain Strategy and Management Office (NCDSMO) accreditation requirements and Raise the Bar (RTB) initiatives.
• Experience implementing Continuous Authorization (cATO) Agile RMF or automated security assessment processes.
• Knowledge of DevSecOps security controls Infrastructure as Code (IaC) and cloud-native security assessment methodologies.

Required Certifications

One of the following current certifications is required:

• Certified Information Security Manager (CISM)
• Certified Authorization Professional (CAP)
• Governance Risk and Compliance (GRC) Certification

Preferred certifications include:

• Certified Information Systems Security Professional (CISSP)
• AWS Certified Security Specialty
• Microsoft Certified: Azure Security Engineer Associate
• Google Professional Cloud Security Engineer

Clearance Requirement

Active Top Secret/Sensitive Compartmented Information (TS/SCI) Clearance Required
SAP Eligibility Required