Senior IT Security SA&A Assessor (Secret, 10+ years) to develop, assess, and authorize security
- Contractor
Our public sector client is seeking a Senior IT Security SA&A Assessor (Secret, 10+ years) to develop, assess, and support the authorization of security documentation for an enterprise-wide modernization program within the public sector.
Join a federal cybersecurity initiative supporting Security Assessment and Authorization (SA&A) activities across multiple departmental technology projects. This role covers the planning, execution, and completion of SA&A deliverables, including SAQs, SCTMs, SoSARs, security evidence reviews, and risk documentation. The successful candidate will assess cloud and on-premises IT systems to ensure alignment with Government of Canada and departmental IT security requirements while supporting a major modernization program.
Contract, Remote, Working Hours: EST
Must Haves
- Secret security clearance
- 10+ years of relevant IT security experience
- ITSG-33 security control tailoring and SCTM development
- Azure DevOps (ADO) experience updating SCTMs, documenting vulnerabilities, conducting risk analysis, and assigning control risk ratings
- Experience conducting SA&A within the Government of Canada
- Experience assessing Microsoft Azure cloud environments
Responsibilities
- Guide business and project teams in completing Security Assessment Questionnaires (SAQs)
- Conduct Detailed Security Categorization (DSC) activities in alignment with Government of Canada security guidance
- Review, develop, and tailor Security Control Traceability Matrices (SCTMs) based on system scope, solution architecture, and applicable security controls
- Coordinate the collection, review, and submission of security evidence packages to support assessment activities
- Update SCTMs in Azure DevOps (ADO), including documenting vulnerabilities, conducting risk analysis, and assigning control risk ratings
- Support the development, review, and refinement of SA&A security documentation, including SoSARs, risk assessments, and authorization artefacts
- Upload finalized SA&A documentation to designated collaboration repositories and complete project closeout activities