Security Control Assessor (SCA)

Job Description

Job Description

PositionTitle:  Security Control Assessor (SCA) 

Primary Location : Arlington, VA and/or Mechanicsburg, Pennsylvania, with assignments in Arlington, Virginia, as required.

Clearance Requirements: Active Secret Clearance

We are seeking a Security Control Assessor (SCA) to join our team. In this critical role, you will be responsible for performing advanced, data-driven security assessments that go beyond simple compliance checks to provide a continuous, mission-focused understanding of cybersecurity risk. You will be a key partner to the Authorizing Official (AO), directly influencing ongoing authorization decisions for critical systems.

Your work will be foundational to DSCA Risk Management Framework (RMF) and Cybersecurity Risk Management Framework (CSRMF) processes. If you are passionate about moving beyond checklists to perform real-world risk analysis and want to make a tangible impact on our nation's security posture, we encourage you to apply.

Key Responsibilities:

• Strategic Assessment Planning : Develop and document transparent Security Assessment Plans (SAP) that clearly define the scope, methodology, resources, and timeline for evaluating system security controls.
• Continuous Security Monitoring : Conduct ongoing assessments of security controls, analyzing and correlating data from security scans, system logs, and automated monitoring tools to build a near real-time picture of system security posture.
• Actionable Risk Analysis : Provide risk analysis that prioritizes vulnerabilities and control deficiencies based on their direct and indirect impact on mission execution. You will use threat intelligence and system-specific context to distinguish significant risks from low-impact findings.
• Validation and Analysis : Interpret and validate the outputs of automated tools, Policy as Code (PaC) scripts, and traditional evidence. You will focus manual testing on non-automatable controls while performing high-level analysis on aggregated data to identify risk trends and systemic weaknesses.
• Authorization Artifact Development : Develop and maintain key authorization artifacts, including the Security Assessment Report (SAR) and Risk Assessment Report (RAR). You will provide critical risk input for the development and maintenance of the Plan of Action and Milestones (POA&M).
• Authorization Recommendation : Synthesize assessment findings and the overall residual risk posture of a system to develop a formal Authorization Recommendation Memo for leadership.
• ATO Lifecycle Management : Manage the program's overarching Authorization to Operate (ATO) schedule. This includes tracking all assessment activities, documentation milestones, and remediation efforts to ensure timely submission and maintenance of the system's authorization status.
• Tool and Data Management : Ensure all activities, evidence, and artifacts are meticulously managed and documented within the Enterprise Mission Assurance Support Service (eMASS).

Required Qualifications:

• Experience : 5+ years of direct experience in cybersecurity, with a focus on security control assessment, risk management, or a related field.
• Knowledge : In-depth knowledge of the Risk Management Framework (RMF), NIST SP 800-53, and related publications. Familiarity with the DoD/Dow Cybersecurity Risk Management Framework (CSRMF) is highly desired.
• Technical Skills : Proven ability to analyze data from security tools, interpret scan results, and validate automated testing outputs. Experience with eMASS is required.
• Analytical Skills : Strong analytical and problem-solving skills, with the ability to understand system-specific context and articulate risk in clear, mission-focused terms.
• Communication : Excellent written and verbal communication skills, with experience drafting formal security assessment reports and briefing senior leadership.
• Clearance : Active Secret security clearance is required.

Preferred Qualifications :

• Bachelor's degree in Cybersecurity, Information Technology, or a related discipline.
• Relevant certifications such as CISSP, CISM, CAP, or equivalent.
• Experience with Policy as Code (PaC) and automating security control validation.
• Experience managing ATO schedules and tracking POA&M remediation efforts.

Work Location

Work is performed within and outside the National Capital Region, primarily in Mechanicsburg, Pennsylvania, where most of the cybersecurity team is based, and in Arlington, Virginia. Duties requiring SIPR access must be completed at an approved DSCA facility.

Compensation

The anticipated pay range has yet to be determined.  Actual compensation may vary based on location, responsibilities, contract affordability, education, knowledge, skills, competencies, experience, and market data. Compensation is one component of ODRG’s total rewards package and is not a promise of specific pay.

About ODRG

Organizational Development Resource Group (ODRG), LLC, provides management consulting and professional services to Department of Defense, federal, commercial, and nonprofit organizations. Our consultants deliver strategic, implementation, and evaluation support designed to improve organizational effectiveness, workforce performance, process efficiency, and cost outcomes.

Candidates may contact their recruiter to request a reasonable accommodation during the application or employment process; information provided will remain confidential and will be used only as needed to provide the accommodation.