Security Control Assessor (SCA) Jobs

Summary

Security Control Assessor

The Security Control Assessor must fulfill a variety of cybersecurity functions, to include: System Administrator, Enterprise Oversight, certification and accreditation, SAP and SCI assessment and authorization (A&A), Platform Information Technology (PIT) assessment and authorization, Information Assurance and Technical Security for AIS, Information Technology (IT) Network Administration & Support, and Information System Security Officer support. Will perform the IA tasks necessary to ensure that the existing DARPA IA program meets National, DoD, and DARPA IA standards, and continues to protect and defend DARPA information and Information Systems (IS) by ensuring the confidentiality integrity, availability, authentication, and non-repudiation of the systems.

The Senior Cybersecurity Specialist possesses experience in successfully participating in DoD Special Access Program Joint Certification and Accreditation, Assessment, and Approval events for DoD Joint cyber ranges and/or jointly accredited SAP information systems. The DARPA systems to be protected include systems that process and store information from controlled unclassified (CUI) up to Top Secret, including SAP and SCI caveats/compartments.

Duties shall include, but are not limited to the following:

• Must possess experience in successfully meeting and participating in Defense Information System Agency (DISA), National Security Agency, and USCBYERCOM Computer Network Defense Program (CNDSP) and CBYERCOM Computer Readiness Inspections (CCRI)
• Experience with network security devices, classified Local Area Networks, Wide Area Networks, public key infrastructure (PKI), virtual machines, and end-point security solutions.
• Must be thoroughly familiar with, understand, and be able to apply the standards and requirements contained in the following:
  • DoD Instruction 5220.22 National Industrial Security Program (NISPOM) Operating Manual, Chapter 8
  • Defense Security Service Manual for the Certification and Accreditation of Classified Systems under the NISPOM Version 3.2
  • DoD Directive 5205.16 The DoD Insider Threat Program
  • NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations
  • DoD Joint Special Access Program Implementation Guide (JSIG)
  • Committee for National Security System Policy (CNSSP) Policy (CNSSP) No. 22 on Information Assurance Risk Management for National Security Systems
  • CNSSP No. 26 National Policy on Reducing the Risk of Removable Media
  • Committed for National Security Systems Directive (CNSSD) No. 504 Directive on Protecting National Security Systems From Insider Threat
  • Committee for National Security System Instruction (CNSSI) No. 1253 Security categorization and Control Selection for National Security Systems
  • DoDD 8000.1, Management of DoD Information Resources and Information Technology
  • DoD Directive 8100.2, Use of Commercial Wireless Devices, Services, and Technologies in the DoD Global Information Grid (GIG)
  • DoDD 8140.01 Cyberspace Workforce Management
  • DoDI 8500.01 Cybersecurity
  • DoD Instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology
  • DoD Directive 8530.1, Computer Network Defense (CND)
  • DoD Instruction 8530.2, Support to CND
  • DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)
  • DoD Manual 8570.01-M Information Assurance Workforce Improvement Program
  • DCID 6/3, Protecting SCI within Information Systems
  • Intelligence Community Directive (ICD) 503
  • Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B Cyber Incident Handling Program
  • Defense Federal Acquisition Regulation Supplement (DFARS)
  • Clause 253.204-7012: Safeguarding Unclassified Controlled Technical Information
  • DoDI 8581.01 Information Assurance Policy for Space Systems Used by the Department of Defense

Note: The legacy cybersecurity/information security accreditation governance documents are listed due to the state of transition of network accreditation guidance and the fact that networks may be operating under legacy certification and accreditation guidance.

Ensure system security requirements are addressed during all phases of DARPA program life cycles (concept development, Request for Information (RFI), Request for Proposal (RFP) or BAA, Proposal, Selection, Award, Closeout, Transition, etc.).

Planning, preparing, and executing inspections, authorization and approval (A&A) events IAW with the respective policies detailed in paragraph 3.12.c. for all classifications of networks; to include the development and review of Automated Information System Authorization and Approval Packages.

Develop, review, endorse, and recommend action by the authorizing official (AO), delegated authorizing official (DAO), or designated approval authority (DAA) for system certification documentation

Conduct quality control of system accreditation packages for completeness of accreditation artifacts within 3 business days of receipt from the technology office security staffs or their cleared defense industry contractors and/or participating government agencies.

Process authorization and approval or denial documentation to the respective DAPRA AO/DAO/or DAA within 10 business days of receipt of a complete package

Conduct security control assessments for the evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an AIS

Provide an assessment of the severity of weaknesses or deficiencies discovered in the information system and its environment of operation and recommend corrective actions to address identified vulnerabilities

Analyze and make recommendations in support of DARPA accredited network Configuration Control Board cases within 10 calendar days of case validation by the respective network's Information System owner

Monitor activities of DARPA accredited networks and DARPA DAO Accredited performer networks

Provide advice, assistance, and analysis of threats and vulnerabilities and risk mitigation and acceptance recommendations, as required. Conduct certification tests that include verification that the features and assurances are functional and support accreditation

Work collaboratively with the MSO/Information Technology Directorate (ITD) in the authorization and approval and continuous monitoring of DARPA unclassified and classified networks; including but not limited to:

• DARPA Management Security System (DMSS) - Unclassified
• DARPA Public Network (DPN) - Unclassified
• DARPA Secret Network (DSN)/Secret Internet Protocol Router Network (SIPRNet) Connection - up to SECRET Collateral
• DARPA Joint Worldwide Intelligence Communications System (JWICS) Network (DJN)/JWICS Connections - up to TOP SECRET SCI
• DARPA Secure Wide Area Network (DSWAN) - up to SECRET Collateral
• Multi-Level Security System (SAVANNAH) - up to TOP SECRET SAP and SCI

Review and recommend changes or amplification of policy, procedures, and strategy development

Evaluate Information Assurance (IA) products and provide written recommendations as to their risk and usefulness and/or adoption for the DARPA IA mission

Evaluate information technology (IT) vulnerabilities to assess whether additional safeguards are prudent and ensure certification is accomplished for each information system

Develop and maintain a formal, written Information Systems Security Program SOP

Ensure all Information System Security Officers (ISSO), network administrators, and other Automated Information Security (AIS) personnel, to include DARPA performers performing these functions, receive the necessary and required technical and security training to carry out their duties

Ensure development and implementation of an information security education, training, and awareness program, to include attending, monitoring, and presenting local AIS security training.

Maintain a repository for all system certification/accreditation documentation and modifications

Coordinate AIS security inspections, tests, and reviews

Prepare policies and procedures for responding to security incidents and for investigating and reporting security violations and incidents

Ensure proper protection or corrective measures have been taken when an incident or vulnerability has been discovered

Assess changes in a system, its environment, or operational needs that could affect the accreditation

Ensure configuration management (CM) for security-relevant AIS software, hardware, and firmware is maintained and documented

Perform system audits on multiple systems; work closely with system administrators and ensure current security measures are sufficient and in compliance with approved policies and processes

Perform, and conduct training as required, for the execution

Job Description

Security Control Assessor

The Security Control Assessor must fulfill a variety of cybersecurity functions, to include: System Administrator, Enterprise Oversight, certification and accreditation, SAP and SCI assessment and authorization (A&A), Platform Information Technology (PIT) assessment and authorization, Information Assurance and Technical Security for AIS, Information Technology (IT) Network Administration & Support, and Information System Security Officer support. Will perform the IA tasks necessary to ensure that the existing DARPA IA program meets National, DoD, and DARPA IA standards, and continues to protect and defend DARPA information and Information Systems (IS) by ensuring the confidentiality integrity, availability, authentication, and non-repudiation of the systems.

The Senior Cybersecurity Specialist possesses experience in successfully participating in DoD Special Access Program Joint Certification and Accreditation, Assessment, and Approval events for DoD Joint cyber ranges and/or jointly accredited SAP information systems. The DARPA systems to be protected include systems that process and store information from controlled unclassified (CUI) up to Top Secret, including SAP and SCI caveats/compartments.

Duties shall include, but are not limited to the following:

• Must possess experience in successfully meeting and participating in Defense Information System Agency (DISA), National Security Agency, and USCBYERCOM Computer Network Defense Program (CNDSP) and CBYERCOM Computer Readiness Inspections (CCRI)
• Experience with network security devices, classified Local Area Networks, Wide Area Networks, public key infrastructure (PKI), virtual machines, and end-point security solutions.
• Must be thoroughly familiar with, understand, and be able to apply the standards and requirements contained in the following:
  • DoD Instruction 5220.22 National Industrial Security Program (NISPOM) Operating Manual, Chapter 8
  • Defense Security Service Manual for the Certification and Accreditation of Classified Systems under the NISPOM Version 3.2
  • DoD Directive 5205.16 The DoD Insider Threat Program
  • NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations
  • DoD Joint Special Access Program Implementation Guide (JSIG)
  • Committee for National Security System Policy (CNSSP) Policy (CNSSP) No. 22 on Information Assurance Risk Management for National Security Systems
  • CNSSP No. 26 National Policy on Reducing the Risk of Removable Media
  • Committed for National Security Systems Directive (CNSSD) No. 504 Directive on Protecting National Security Systems From Insider Threat
  • Committee for National Security System Instruction (CNSSI) No. 1253 Security categorization and Control Selection for National Security Systems
  • DoDD 8000.1, Management of DoD Information Resources and Information Technology
  • DoD Directive 8100.2, Use of Commercial Wireless Devices, Services, and Technologies in the DoD Global Information Grid (GIG)
  • DoDD 8140.01 Cyberspace Workforce Management
  • DoDI 8500.01 Cybersecurity
  • DoD Instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology
  • DoD Directive 8530.1, Computer Network Defense (CND)
  • DoD Instruction 8530.2, Support to CND
  • DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)
  • DoD Manual 8570.01-M Information Assurance Workforce Improvement Program
  • DCID 6/3, Protecting SCI within Information Systems
  • Intelligence Community Directive (ICD) 503
  • Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B Cyber Incident Handling Program
  • Defense Federal Acquisition Regulation Supplement (DFARS)
  • Clause 253.204-7012: Safeguarding Unclassified Controlled Technical Information
  • DoDI 8581.01 Information Assurance Policy for Space Systems Used by the Department of Defense

Note: The legacy cybersecurity/information security accreditation governance documents are listed due to the state of transition of network accreditation guidance and the fact that networks may be operating under legacy certification and accreditation guidance.

Ensure system security requirements are addressed during all phases of DARPA program life cycles (concept development, Request for Information (RFI), Request for Proposal (RFP) or BAA, Proposal, Selection, Award, Closeout, Transition, etc.).

Planning, preparing, and executing inspections, authorization and approval (A&A) events IAW with the respective policies detailed in paragraph 3.12.c. for all classifications of networks; to include the development and review of Automated Information System Authorization and Approval Packages.

Develop, review, endorse, and recommend action by the authorizing official (AO), delegated authorizing official (DAO), or designated approval authority (DAA) for system certification documentation

Conduct quality control of system accreditation packages for completeness of accreditation artifacts within 3 business days of receipt from the technology office security staffs or their cleared defense industry contractors and/or participating government agencies.

Process authorization and approval or denial documentation to the respective DAPRA AO/DAO/or DAA within 10 business days of receipt of a complete package

Conduct security control assessments for the evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an AIS

Provide an assessment of the severity of weaknesses or deficiencies discovered in the information system and its environment of operation and recommend corrective actions to address identified vulnerabilities

Analyze and make recommendations in support of DARPA accredited network Configuration Control Board cases within 10 calendar days of case validation by the respective network's Information System owner

Monitor activities of DARPA accredited networks and DARPA DAO Accredited performer networks

Provide advice, assistance, and analysis of threats and vulnerabilities and risk mitigation and acceptance recommendations, as required. Conduct certification tests that include verification that the features and assurances are functional and support accreditation

Work collaboratively with the MSO/Information Technology Directorate (ITD) in the authorization and approval and continuous monitoring of DARPA unclassified and classified networks; including but not limited to:

• DARPA Management Security System (DMSS) - Unclassified
• DARPA Public Network (DPN) - Unclassified
• DARPA Secret Network (DSN)/Secret Internet Protocol Router Network (SIPRNet) Connection - up to SECRET Collateral
• DARPA Joint Worldwide Intelligence Communications System (JWICS) Network (DJN)/JWICS Connections - up to TOP SECRET SCI
• DARPA Secure Wide Area Network (DSWAN) - up to SECRET Collateral
• Multi-Level Security System (SAVANNAH) - up to TOP SECRET SAP and SCI

Review and recommend changes or amplification of policy, procedures, and strategy development

Evaluate Information Assurance (IA) products and provide written recommendations as to their risk and usefulness and/or adoption for the DARPA IA mission

Evaluate information technology (IT) vulnerabilities to assess whether additional safeguards are prudent and ensure certification is accomplished for each information system

Develop and maintain a formal, written Information Systems Security Program SOP

Ensure all Information System Security Officers (ISSO), network administrators, and other Automated Information Security (AIS) personnel, to include DARPA performers performing these functions, receive the necessary and required technical and security training to carry out their duties

Ensure development and implementation of an information security education, training, and awareness program, to include attending, monitoring, and presenting local AIS security training.

Maintain a repository for all system certification/accreditation documentation and modifications

Coordinate AIS security inspections, tests, and reviews

Prepare policies and procedures for responding to security incidents and for investigating and reporting security violations and incidents

Ensure proper protection or corrective measures have been taken when an incident or vulnerability has been discovered

Assess changes in a system, its environment, or operational needs that could affect the accreditation

Ensure configuration management (CM) for security-relevant AIS software, hardware, and firmware is maintained and documented

Perform system audits on multiple systems; work closely with system administrators and ensure current security measures are sufficient and in compliance with approved policies and processes

Perform, and conduct training as required, for the execution