Security Control Assessor/Representatives
Darkwolfsolutions · Arlington, VA
About this role
## Dark Wolf Solutions — Security Control Assessor/Representatives (SCA/Rs) **Location:** Arlington, VA **Clearance:** Active Top Secret ### Overview Dark Wolf Solutions is seeking **Security Control Assessor/Representatives (SCA/Rs)** to lead security control assessments across high-priority projects. You’ll work at the intersection of **cybersecurity engineering, cloud architecture, and DevSecOps prototyping**, evaluating security controls for **AI/LLM technologies** across multiple classification levels. ### Key Responsibilities - Execute formal **SCA/R** duties - Lead security assessment efforts; develop reusable **security playbooks** and **assessment frameworks** for rapid AI deployment - Evaluate control effectiveness across **AWS**, **DevSecOps pipelines**, **microservices**, **containerized workloads**, and **GenAI/LLM application stacks** - Partner with cybersecurity engineering and DevSecOps prototyping teams to integrate controls early in the SDLC - Review, author, and maintain assessment packages, including **SSPs, SAPs, SARs, and POA&Ms** (tailored to rapid prototyping and AI systems) - Assess AI/LLM-specific technical security risks (e.g., API exposure, vector database access controls, model integration surface area, software supply chain dependencies) - Support **continuous monitoring (ConMon)**, technical risk evaluations, and cloud architecture reviews in **multi-tenant, multi-classification** environments - Coordinate with **Authorizing Officials (AOs)**, program managers, and engineering leads to deliver decision-ready risk briefings and **ATO recommendations** - Provide technical input/oversight for cybersecurity engineering and penetration testing activities across prototype projects ### Required Qualifications - **Active Top Secret** clearance - **DoD 8570/8140 IAM Level II or Level III** certification (e.g., Security+, CySA+, CISM, CISSP, CCISO, CAP/CISC) - **3–5+ years** conducting security control assessments, compliance testing, or **A&A/RMF** activities for DoD or federal information systems - Strong operational understanding of core **AWS** services (EC2, S3, IAM, VPCs, Security Groups, Security Hub) and how controls function in cloud-native + CI/CD environments - Working knowledge of **NIST SP 800-53 (Rev. 4/5)**, **NIST SP 800-37 (RMF)**, **DoD Cloud Computing SRG**, and **FedRAMP** baselines - Demonstrated experience writing/evaluating RMF artifacts (**SSPs, SAPs, SARs, POA&Ms**) - Exceptional written/verbal communication; ability to clearly articulate technical risk to executives, AOs, and engineering teams - Experience navigating government GRC repositories such as **eMASS** or **XACTA** ### Desired Qualifications - Experience mapping security controls to **NIST AI RMF**, **OWASP Top 10 for LLM Applications**, or **DoD Responsible AI (RAI) Guidelines** - Familiarity evaluating secure design patterns for autonomous AI agents (tool-calling permissions, sandboxing, prompt boundaries, ReAct/LangGraph architectures) - Experience assessing cloud-managed AI ecosystems and foundation model platforms (e.g., **AWS Bedrock**, **AWS SageMaker**, **Hugging Face Enterprise**, or self-hosted open-source models) - Understanding of data protection/access controls/boundary security for **RAG** pipelines and vector databases (e.g., OpenSearch Vector Engine, Pinecone, Milvus, pgvector) - Familiarity with LLM-specific risks (prompt injection, data poisoning, model inversion, insecure output handling, open-source AI l
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.