Offensive Security Control Assessor Security Control Assessor Representative
Darkwolfsolutions · Washington DC Metro Area
About this role
**Dark Wolf Solutions** is seeking **Security Control Assessor/Representatives (SCA/Rs)** to lead security control assessments across high-priority projects. You’ll work at the intersection of **cybersecurity engineering, cloud architecture, and DevSecOps prototyping**, evaluating security controls for **cutting-edge AI/LLM technologies** across multiple classification levels. **Location:** Arlington, VA (**hybrid/remote opportunities**) --- ### Key Responsibilities - Execute formal **SCA/R** duties - Lead security assessment efforts; establish reusable **security playbooks** and **assessment frameworks** for rapid AI deployment - Evaluate technical control effectiveness across **AWS**, **DevSecOps pipelines**, **microservices**, **containerized workloads**, and **GenAI/LLM application stacks** - Bridge the gap between OffSec and development; lead **TEMs**, participate in **Discovery & Framing** workshops, and coordinate with cross-functional stakeholders - Serve as primary SME and lead developer for **custom offensive tooling**, integrating capabilities into a mission-ready platform - Review, author, and maintain assessment packages including **SSPs, SAPs, SARs, and POA&Ms** (tailored to rapid prototyping and AI systems) - Assess AI/LLM-specific security risks (e.g., **API exposure**, **vector database access controls**, **model integration surface area**, **software supply chain dependencies**) - Support **continuous monitoring (ConMon)**, technical risk evaluations, and cloud architecture reviews across **multi-tenant/multi-classification** environments - Coordinate with **Authorizing Officials (AOs)**, program managers, and engineering leads to deliver decision-ready risk briefings and **ATO recommendations** - Provide technical input and oversight for cybersecurity engineering and penetration testing activities across prototype projects --- ### Required Qualifications - **Active Top Secret** security clearance - Current **DoD 8570/8140 IAM Level II or Level III** certification (e.g., **Security+, CySA+, CISM, CISSP, CCISO, CAP/CISC**) - **5–7+ years** experience conducting security control assessments, compliance testing, or **A&A/RMF** activities for DoD or federal information systems - Solid operational understanding of core **AWS** services (EC2, S3, IAM, VPCs, Security Groups, Security Hub) and how controls function in cloud-native + CI/CD environments - Experience with **GitLab CI/CD** (pipeline design, runners, artifact management) and AWS Cloud services (EC2, VPC, IAM, S3) - Strong working knowledge of **NIST SP 800-53 (Rev. 4/5)**, **NIST SP 800-37 (RMF)**, **DoD Cloud Computing SRG**, and **FedRAMP** baselines - Demonstrated experience writing/evaluating core RMF artifacts (**SSPs, SAPs, SARs, POA&Ms**) - Exceptional written/verbal communication; ability to clearly articulate technical risk to executives, AOs, and engineering teams - Hands-on experience navigating government **GRC repositories** (e.g., **eMASS** or **XACTA**) --- ### Desired Qualifications - Hands-on experience mapping security controls to **NIST AI RMF**, **OWASP Top 10 for LLM Applications**, or **DoD Responsible AI (RAI) Guidelines** - Familiarity evaluating secure design patterns for **autonomous AI agents** (tool-calling permissions, sandboxing, prompt boundaries, ReAct/LangGraph architectures) - Experience assessing cloud-managed AI ecosystems and foundation model platforms (e.g., **AWS Bedrock**, **AWS SageMaker**, **Hugging Face Enterprise*
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.