Security Control Assessor Representative (SCAR)

Required Skills & Experience

• 2+ years of experience in network engineering, architecture, or security engineering.
• Experience with cloud environments (AWS, Azure, GCP, or Oracle Cloud).
• Hands-on experience with enterprise security technologies (Splunk, Palo Alto, Cisco, Zscaler, Microsoft Security, ELK, etc.).
• Experience with enterprise security architecture and cyber security best practices.
• Familiarity with NIST, RMF, FedRAMP, FISMA, and related security frameworks.
• Knowledge of Zero Trust Architecture (ZTA) principles.
• Active Secret Clearance.

Nice to Have Skills & Experience

• Active IA Level III certification (CISSP, CASP+, CCSP, CISA, GCIH, GCED, etc.).
• Experience supporting DoD or federal government environments.
• Experience implementing Zero Trust strategies, assessments, or roadmaps.
• Knowledge of SASE, SD-WAN, SOAR, UEBA, IAM, threat modeling, or cloud security.
• Cloud security certifications (AWS, Azure, GCP).
• Advanced cyber certifications (CISSP-ISSAP, GCIA, GCSA, GCLD, etc.).
• Experience with Visibility & Analytics, SIEM, and security operations.

Job Description

A client is seeking an experienced Secret Security Control Assessor Representative (SCAR) to support a large Department of Defense cybersecurity program at Scott Air Force Base. This individual will serve as an independent cybersecurity assessor responsible for evaluating security controls, validating RMF compliance, and supporting authorization decisions for enterprise systems supporting critical DoD missions. This position functions as a cybersecurity auditor and risk assessor, reviewing documentation, security controls, and authorization packages to determine whether systems are secure, compliant with DoD requirements, and capable of receiving Authorization to Operate (ATO) approval. The SCAR will support more than 40 Programs of Record across the enterprise and act as a trusted advisor to the Security Control Assessor (SCA) and Authorizing Official (AO) by providing risk-based recommendations and independent assessments.

Key Responsibilities

• Conduct independent security control assessments to evaluate the effectiveness of management, operational, technical, and privacy controls.
• Review RMF documentation including: ○ System Security Plans (SSPs) ○ Plans of Action & Milestones (POA&Ms) ○ Security Categorization Packages ○ Authorization Packages ○ Risk Acceptance Requests
• Assess security artifacts and identify cybersecurity risks, compliance gaps, and control deficiencies.
• Perform Independent Verification & Validation (IV&V) activities within eMASS to ensure controls are: ○ Implemented correctly ○ Operating as intended ○ Producing desired security outcomes
• Provide recommendations for risk acceptance, remediation activities, and authorization decisions.
• Support Security Control Assessor (SCA) activities and Authorizing Official (AO) package preparation.
• Compile and coordinate authorization packages and required approval documentation for leadership review.
• Review and triage RMF submissions using Government Artifact Quality Rubrics.
• Document deficiencies through Package Return Reports (PRRs) and coordinate corrective actions.
• Support risk analysis efforts and provide technical recommendations to government stakeholders.
• Track authorization package status from submission through approval or denial.
• Maintain cybersecurity compliance records and authorization documentation.
• Manage eMASS user accounts and permissions as directed.
• Provide subject matter expertise on RMF processes, cybersecurity controls, and DoD compliance requirements.
• Collaborate with system owners, ISSOs, cybersecurity teams, and government stakeholders to ensure successful system authorizations.