Lead Security Control Assessor

Booz Allen Hamilton

. Direct the SCA workstream and provide independent cybersecurity assessment leadership for CDAO systems and environments .

Posted 9/15/2026full-timeAlexandria • Maryland • United StatesSenior💰 $99,000 - $225,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in cybersecurity assessment leadership, particularly within DoD RMF frameworks, and possesses strong capabilities in risk management, technical writing, and stakeholder coordination. Proficient in utilizing tools such as eMASS and conducting thorough security control assessments to ensure compliance and effectiveness.

Highest-signal resume keywords

Cybersecurity Assessment LeadershipDoD RMF ExperienceEMASS AdministrationTechnical WritingStakeholder Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security Control AssessmentRisk AssessmentAuthorization Package ProductionVulnerability ManagementAutomated Security ScanningWindows AdministrationLinux AdministrationAWS Cloud ManagementContainerization SystemsTechnical Evidence Analysis

Soft Skills

Team LeadershipFacilitationQuality AssuranceCommunicationMentoring

Tools & Technologies

EMASSSTIGSCAPACASPOA&M

Certifications & Qualifications

TS/SCI Clearance

Industry Keywords

NIST SP 800-53NIST SP 800-37Cybersecurity PolicySecurity-Control Assessment MethodologyContinuous Monitoring

Tech Stack

Tools & technologies

AWSCloudCyber SecurityLinuxTypeScript

About the role

Key responsibilities & impact

Direct the SCA workstream and provide independent cybersecurity assessment leadership for CDAO systems and environments
Own assessment strategy, quality standards, stakeholder coordination, risk adjudication, and final review of SAPs and SARs
Advise technical leadership and AO stakeholders on control effectiveness, authorization readiness, and residual cybersecurity risk
Develop and govern assessment approaches, schedules, evidence standards, test procedures, and quality-control frameworks
Administer eMASS and analyze STIG, SCAP, ACAS, POA&M, architecture, inherited-control, compensating-control, and technical evidence
Work with the project ISSM to understand customer cybersecurity RMF requirements
Lead independent security control assessments according to DoD RMF, NIST guidance, DoD cybersecurity policy, and organizational procedures
Brief findings and risk recommendations to ISSM, AO representatives, and AO-level stakeholders
Develop, validate, and input system-applicable RMF Body of Evidence documentation into approved databases such as eMASS or AO SharePoint
Review and approve SAPs and SARs for technical accuracy, evidence sufficiency, traceability, consistency, and defensibility
Coordinate with system owners, ISSMs, ISSOs, cybersecurity engineers, administrators, developers, program leadership, control providers, and AO representatives
Review system boundaries, data flows, external interfaces, interconnections, inherited controls, common-control dependencies, and significant changes
Oversee assessments for ATO, reauthorization, annual assessment, significant-change assessment, and continuous monitoring activities
Brief assessment status, systemic risks, unresolved findings, remediation priorities, and authorization recommendations to senior stakeholders
Mentor assessors, calibrate assessment judgments, and ensure independence and objectivity
Develop and maintain stakeholder relationships

Requirements

What you’ll need

8+ years of experience with cybersecurity, including substantial DoD or federal RMF, security assessment, security engineering, or authorization experience
Experience with eMASS, STIG, SCAP, ACAS findings, POA&Ms, architecture, inherited controls, compensating controls, and technical evidence
Experience leading security control assessments and producing or approving SSPs, SAPs, SARs, POA&Ms, risk assessments, and authorization packages
Experience administering Windows, Linux, AWS Cloud, and containerization systems and software configuration
Experience with technical writing, facilitation, quality assurance, team leadership, and stakeholder management
Knowledge of NIST SP 800-53, NIST SP 800-37, DoD RMF, STIGs, vulnerability management, and security-control assessment methodology
Ability to evaluate complex enterprise, cloud, hybrid, containerized, data, and AI-enabled architectures and communicate risks at AO and executive levels
Ability to lead, organize, and complete cybersecurity testing events using automated security scanning tools, manual STIGs and SRGs, and result analysis
TS/SCI clearance required
Bachelor's degree in a technical field such as Engineering or Cyber
Experience reviewing system connection requests
Experience performing dynamic security assessments
Ability to communicate test outcomes and risks, suggest fixes, and document and track POA&M remediation
Ability to adjudicate complex findings, evaluate compensating controls and mitigations, validate risk determinations, and advise on residual mission risk
Ability to lead quarterly Cyber Resilience and Continuous Monitoring reviews

Benefits

Comp & perks

Health benefits
Life insurance
Disability benefits
Financial benefits
Retirement benefits
Paid leave
Professional development
Tuition assistance
Work-life programs
Dependent care
Recognition awards program for exceptional performance and superior demonstration of values
Identity verification process with advanced biometrics and artificial intelligence
Camera use during interviews and assessments