Security Control Assessor/Representatives

Location: Arlington, VA. This role is a direct, full‑time W2 position (no third‑party staffing agencies, C2C, or 1099 contractors).

Responsibilities

• Execute formal SCA/R duties.
• Lead security assessment efforts, establishing reusable security playbooks and assessment frameworks for rapid AI deployment into enterprise workflows.
• Evaluate technical control effectiveness across AWS cloud infrastructure, DevSecOps pipelines, microservices, containerized workloads, and GenAI/LLM application stacks.
• Partner directly with cybersecurity engineering and DevSecOps prototyping teams to integrate security controls early in the development lifecycle.
• Review, author, and maintain assessment packages—including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and POA&Ms—tailored to rapid prototyping and AI systems.
• Assess technical security risks specific to AI/LLM implementations, such as API exposure, vector database access controls, model integration surface area, and software supply chain dependencies.
• Support continuous monitoring (ConMon), technical risk evaluations, and cloud architecture reviews across multi‑tenant, multi‑classification environments.
• Coordinate with Authorizing Officials (AOs), program managers, and engineering leads to deliver decision‑ready risk briefings and ATO recommendations.
• Provide technical input and oversight for cybersecurity engineering and penetration testing activities across prototype projects.

Required Qualifications

• Active Top Secret security clearance.
• Current DoD 8570/8140 IAM Level II or Level III certification (e.g., Security+, CySA+, CISM, CISSP, CCISO, CAP/CISC).
• 3–5+ years of experience conducting security control assessments, compliance testing, or A&A/RMF activities for DoD or federal information systems.
• Solid operational understanding of core AWS cloud services (EC2, S3, IAM, VPCs, Security Groups, Security Hub) and how security controls function within cloud‑native and CI/CD pipeline environments.
• Strong working knowledge of NIST SP