Active Secret clearance required; must be able to obtain TSA clearance
Knowledge of Security Assessment & Authorization (A&A), Ongoing Authorization (OA), and Risk Assessment (RA) processes
Ability to assess and validate security controls for authorization activities
Understanding of security authorization package development and documentation requirements
Familiarity with GRC tools, including CSAM
Knowledge of security standards, control frameworks, and system hardening requirements
Strong collaboration and communication skills for engaging with technical and cybersecurity stakeholders
Responsibilities
Serve as an independent Security Control Assessor (SCA) providing A&A, OA, and RA support
Plan, coordinate, and execute security assessments, including scheduling and stakeholder engagement
Assess security controls, analyze vulnerabilities, and support remediation planning
Develop and manage Security Authorization Packages and related documentation
Document and maintain assessment results and authorization artifacts within approved repositories
Review security standards and assessment results to support risk determinations
Support the development of security assessment methodologies and emerging frameworks
Benefits
Opportunity to work with TSA's Governance, Risk, and Compliance mission
Engagement in cutting-edge cybersecurity practices
Collaboration with a diverse team of cybersecurity professionals
Potential for professional growth and development in a dynamic environment
Involvement in the refinement of security assessment methodologies
Full Job Description
***AWARD PENDING***
Zen Strategics, a Titan Technologies company, is seeking a Senior Security Control Assessor (SCA) to support TSA's Governance, Risk, and Compliance (GRC) mission. The position will assist in safeguarding the availability, integrity, and confidentiality of information systems through cybersecurity governance, risk management, security assessment, and compliance activities that support TSA's Information Assurance and Cybersecurity Division.
Duties and Responsibilities:
Serve as an independent Security Control Assessor (SCA), providing Security Assessment & Authorization (A&A), Ongoing Authorization (OA), and Risk Assessment (RA) support.
Plan, coordinate, and execute security assessments, including project scheduling, kickoff meetings, security control evaluations, and stakeholder engagement with ISSOs, System Owners, Administrators, Developers, and Engineers.
Assess security controls, analyze vulnerabilities and security findings, perform risk analysis, and support remediation planning activities.
Develop, maintain, and manage Security Authorization Packages, Risk Assessment Memorandums (RAMs), POA&Ms, Privileged Account Audits, and other authorization-related documentation.
Document, track, and maintain assessment results, evidence, findings, and authorization artifacts within CSAM and other approved governance, risk, and compliance repositories.
Review security standards, hardening requirements, and assessment results to support authorization decisions and risk determinations.
Support the development and refinement of security assessment methodologies, procedures, and requirements, including emerging security frameworks and controls.
You MUST have:
Active Secret clearance required; Must be able to obtain TSA clearance
Knowledge of Security Assessment & Authorization (A&A), Ongoing Authorization (OA), and Risk Assessment (RA) processes.
Ability to assess and validate security controls in support of authorization activities.
Understanding of security authorization package development and supporting documentation requirements.
Ability to develop and maintain authorization packages, POA&Ms, RAMs, and related security documentation.
Familiarity with GRC tools, including CSAM, and security compliance requirements.
Knowledge of security standards, control frameworks, and system hardening requirements.
Ability to conduct security audits, analyze findings, and support remediation efforts.
Strong collaboration and communication skills for working with technical, cybersecurity, and system stakeholders.
It's GREAT if you also have:
Knowledge of security assessment methodologies and emerging security frameworks, including Zero Trust.
Familiarity with DISA STIGs, DISA SRGs, and system hardening requirements.
Understanding of vulnerability assessments, penetration testing, and risk assessment activities.
Familiarity with security assessment tools such as Tenable/Nessus, AppDetective, WebInspect, AppScan, and Nipper.
Ability to develop security reports, briefings, and risk-based recommendations.
Education:
BA/BS degree in Cybersecurity, Information Technology, or a related discipline plus seven (7) years of experience
