Senior Security Control Assessor, SCA
MBL Technologies Inc.
Cyber SecurityJavaScript
Security Control Assessor – Midlevel
MBL Technologies Inc.
full-time
Posted on:
Origin: • 🇺🇸 United States • District of Columbia, Virginia
Visit company websiteJob Level
Mid-LevelSenior
Tech Stack
Cyber SecurityJavaScript
About the role
- Independently conducts security control assessments, supports system authorization activities, and contributes to organizational risk management
- Perform security reviews to identify architectural gaps and provide recommendations for risk mitigation
- Conduct risk analyses (e.g., threats, vulnerabilities, probability of occurrence) during significant system/application changes
- Plan and execute security authorization reviews, assurance case development, and audits for system installations and networks
- Provide input to the Risk Management Framework (RMF) and related documentation, including lifecycle support plans, CONOPS, and operational procedures
- Review authorization packages and assurance documents to confirm risk levels are acceptable for systems, applications, and networks
- Verify that system, network, and application security postures are implemented as designed, documenting deviations and recommending corrective actions
- Assess the effectiveness of implemented security controls across management, operational, and technical areas
- Support compliance activities by ensuring security configuration guidelines and standards are followed
- Evaluate configuration management and release processes for security impacts
- Define/document how new systems or interfaces affect the organization’s current security posture
- Develop security compliance processes and perform audits of external services (e.g., CSPs, data centers)
- Ensure Plans of Action & Milestones (POA&Ms) and remediation plans are established for vulnerabilities
- Participate in Risk Governance processes by presenting risks, mitigations, and technical assessments
- Support acquisition and procurement efforts to ensure information security requirements are integrated
- Produce reports, briefings, and technical documentation reflecting assessment results and recommendations
Requirements
- 4-6 years of relevant IT/cybersecurity experience
- Bachelor's degree in a technical/cyber-related field (or equivalent experience/certifications)
- Proficiency in assessing security controls against standards (e.g., NIST SP 800-53, CIS CSC, Cybersecurity Framework)
- Strong skills in vulnerability scanning, penetration testing principles, and interpreting results
- Ability to conduct risk, impact, and compliance assessments
- Skill in technical documentation, briefings, and audit reporting
- Proficiency in security architecture review and system design evaluation
- Knowledge of secure coding principles and application security (e.g., OWASP Top 10)
- Experience applying confidentiality, integrity, and availability principles to systems and networks
- Familiarity with compliance frameworks and security assessment tools
- Strong analytical, technical writing, and communication skills
- Ability to evaluate and synthesize risk assessment data into actionable findings
- Ability to clearly communicate technical and risk information to technical and non-technical audiences
- Ability to assess vulnerabilities and recommend corrective actions
- Ability to apply judgment in ambiguous or evolving situations
- Ability to interpret and apply relevant cybersecurity laws, regulations, and policies
- Ability to collaborate across teams and work effectively with external service providers
- Knowledge: RMF and SA&A processes; security architecture concepts; network security protocols; government compliance standards; information security principles; applicable laws (e.g., NIST SP 800-161, FISMA, FedRAMP); system and application security threats; IT supply chain security; cyber defense and vulnerability assessment tools
