DoW Security Control Assessor (SCA)

Liberty Alliance is seeking an experienced DoW Security Control Assessor (SCA) with Information System Security Officer (ISSO) experience to evaluate information systems, identify security control deficiencies, and independently develop missing Risk Management Framework (RMF) documentation to support system authorization.

This position requires a hands-on cybersecurity professional who can not only assess security controls and identify compliance gaps but also independently create, update, and finalize required security artifacts. The SCA will utilize DoW RMF tools, primarily eMASS (Enterprise Mission Assurance Support Service), to manage security documentation, track control statuses, and prepare authorization packages. This role will work closely with technical engineering teams, Information System Security Managers (ISSMs), and Authorizing Official (AO) representatives to resolve compliance deficiencies and support Authorization to Operate (ATO) requirements.

Key Responsibilities

Security Control Assessment

• Plan and execute formal security assessments to determine whether system security controls are implemented correctly and operating effectively.
• Develop Security Assessment Plans (SAPs) defining assessment scope, schedules, and system boundaries.
• Assess NIST SP 800-53 security controls using examination, interviews, and technical testing.
• Review security policies, system logs, configurations, and supporting evidence to validate compliance.
• Interview system engineers and administrators to verify security control implementation.
• Review and analyze vulnerability scans, including ACAS/Nessus results and STIG Viewer checklists, to identify technical compliance deficiencies.

RMF Documentation & Artifact Development

• Review existing RMF packages to identify missing, incomplete, or outdated security documentation.
• Independently draft, update, and finalize required security artifacts, including:
  • System Security Plans (SSPs)
  • Security Assessment Plans (SAPs)
  • Information System Contingency Plans (ISCPs)
  • Incident Response Plans (IRPs)
  • Configuration Management Plans (CMPs)
  • Plans of Action and Milestones (POA&Ms)
  • Disaster recovery testing documentation and supporting evidence
• Translate technical system configurations, such as firewall rules and Active Directory policies, into clear, accurate, and compliance-ready documentation.
• Ensure security documentation meets NIST SP 800-53 and applicable DoW RMF requirements.
• Utilize Microsoft Word, Google Docs, and other approved tools to develop and maintain professional security documentation.

eMASS & Authorization Support

• Utilize eMASS to upload and maintain RMF artifacts, track security control statuses, and prepare authorization packages.
• Identify and resolve documentation gaps and compliance bottlenecks.
• Coordinate with system engineers, ISSMs, and AO representatives to support system authorization activities.

Risk Assessment & Continuous Monitoring

• Develop comprehensive Security Assessment Reports (SARs) documenting assessment findings, vulnerabilities, and the system's overall compliance posture.
• Evaluate the severity of noncompliant security controls and assess residual cybersecurity risk.
• Develop and maintain POA&Ms to document vulnerabilities and corrective actions.
• Provide actionable risk findings and recommendations to support AO authorization decisions.
• Plan and execute annual security control assessments and continuous monitoring activities to maintain system Authorization to Operate (ATO).

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related technical field; equivalent professional experience may be considered.
• Experience serving as a DoW Security Control Assessor (SCA) with prior Information System Security Officer (ISSO) responsibilities.
• Strong knowledge of the DoW Risk Management Framework (RMF) and NIST SP 800-53 security controls.
• Hands-on experience with eMASS, including artifact management, control tracking, and authorization package preparation.
• Demonstrated ability to independently develop RMF documentation, including SSPs, SAPs, SARs, ISCPs, IRPs, CMPs, and POA&Ms.
• Experience conducting security control assessments through examination, interviews, and technical testing.
• Experience reviewing ACAS/Nessus vulnerability scans and STIG Viewer checklists.
• Strong technical understanding of system configurations, network security, access controls, and cybersecurity compliance.
• Excellent technical writing skills and proficiency with Microsoft Word and/or Google Docs.
• Ability to independently identify compliance gaps, develop missing documentation, and coordinate corrective actions.
• Strong communication and organizational skills with the ability to collaborate with engineering teams, ISSMs, and government stakeholders.
• Ability to obtain and maintain any required DoW security clearance.

Preferred Qualifications

• Experience supporting DoW Authorization to Operate (ATO) processes.
• Familiarity with NIST SP 800-37, NIST SP 800-53A, and DoW RMF requirements.
• Experience supporting continuous monitoring and cybersecurity risk assessments.
• Relevant cybersecurity certifications such as Security , CISSP, or CGRC.