Security Control Assessor - Validator (SCA-V)

Job Description

Job Description

Position : Security Control Assessor - Validator (SCA-V)

Clearance Requirements : Active Secret Clearance

Primary Location : Arlington, VA and/or Mechanicsburg, Pennsylvania, with assignments in Arlington, Virginia, as required.

We are seeking a Security Control Assessor - Validator (SCA-V) to serve as an independent verification and validation agent for security controls on critical government information systems. In this role, you will be instrumental in supporting the Authorizing Official (AO) by conducting independent, compliant, and comprehensive security control assessments.

Your primary objective will be to ensure the accuracy and integrity of assessment evidence, moving beyond simple acceptance of automated outputs to provide a true, risk-informed picture of a system's security posture. You will be a key player in the authorization process, ensuring that all findings are validated, all risks are clearly communicated, and all decisions are supported by trustworthy evidence within the Enterprise Mission Assurance Support Service (eMASS).

Key Responsibilities:

• Independent Assessment Execution : Conduct comprehensive Security Control Assessments in accordance with the assessment schedule and the Security Assessment Plan (SAP). This includes interviewing personnel, examining documentation, inspecting configurations, and performing technical testing of implemented controls.
• Critical Validation of Evidence : Independently validate and critically analyze the accuracy of all test results, including outputs from automated scanning tools, penetration tests, and manual checks. You will ensure all evidence is valid, relevant, and correctly interpreted before it is documented as a formal finding.
• Proactive Communication : Maintain a "no surprises" approach by providing timely and continuous status updates to the government SCA and ISSM throughout the assessment lifecycle. You will be responsible for the immediate notification of critical or high-risk findings upon discovery.
• Compliance as Code (CaC) Validation : Apply expert-level knowledge to review and validate security controls defined and executed through Compliance as Code (CaC) frameworks. You will assess the accuracy of CaC profiles and scripts, validate that automated evidence is trustworthy and not prone to false positives/negatives, and verify its correct ingestion into eMASS.
• eMASS System of Record Management : Maintain master-level proficiency in eMASS, utilizing it as the authoritative system of record. You will accurately and timely document all assessment activities, findings, evidence, and results, including updating control status, populating test results, and uploading objective evidence.
• Risk Analysis and Mitigation Support : Perform in-depth risk analysis on identified vulnerabilities, assessing the likelihood of exploitation and potential mission impact. You will provide clear, actionable mitigation recommendations and collaborate with system owners to review, refine, and validate Plan of Action and Milestones (POA&M) documentation.
• Authorization Package Development : Prepare and assemble the comprehensive Security Authorization Package for submission. You will develop the detailed Security Assessment Report (SAR) and be available to brief the SCA, ISSM, and other stakeholders on assessment results to support the final authorization recommendation.

Required Qualifications:

• Experience : 5+ years of direct experience in cybersecurity, with a focus on security control assessment, validation, and independent verification.
• Knowledge : In-depth knowledge of the Risk Management Framework (RMF), NIST SP 800-53, and DISA Security Technical Implementation Guides (STIGs).
• Technical Skills : Proven experience with eMASS is required. Demonstrated expertise in validating and interpreting data from automated assessment tools (e.g., AWS Inspector, Security Hub, ACAS, Nessus).
• Analytical Skills : Exceptional analytical and critical thinking skills, with a proven ability to independently verify evidence and distinguish significant risks from low-impact findings.
• Communication : Excellent written and verbal communication skills, with experience drafting formal Security Assessment Reports (SAR) and briefing senior leadership.
• Clearance: Active Secret security clearance is required.

Preferred Qualifications:

• Bachelor's degree in Cybersecurity, Information Technology, or a related discipline.
• Relevant certifications such as CISSP, CAP, or equivalent.
• Hands-on experience with Compliance as Code (CaC) frameworks and tools.
• Experience collaborating with ISSOs and system owners on POA&M development and risk mitigation strategies.
• Experience preparing and assembling full Security Authorization Packages.

Work Location

Work is performed within and outside the National Capital Region, primarily in Mechanicsburg, Pennsylvania, where most of the cybersecurity team is based, and in Arlington, Virginia. Duties requiring SIPR access must be completed at an approved DSCA facility.

Compensation

The anticipated pay range has yet to be determined. Actual compensation may vary based on location, responsibilities, contract affordability, education, knowledge, skills, competencies, experience, and market data. Compensation is one component of ODRG’s total rewards package and is not a promise of specific pay.

About ODRG

Organizational Development Resource Group (ODRG), LLC provides management consulting and professional services to Department of Defense, federal, commercial, and nonprofit organizations. Our consultants deliver strategic, implementation, and evaluation support designed to improve organizational effectiveness, workforce performance, process efficiency, and cost outcomes.

Candidates may contact their recruiter to request a reasonable accommodation during the application or employment process; information provided will remain confidential and will be used only as needed to provide the accommodation.