AI Security Control Assessor (SCA)

SAIC • Arlington, VA

3d • Onsite

About The Position

SAIC is seeking Security Control Assessors/Representatives (SCA/Rs) to lead security control assessments across high-priority projects. Working at the intersection of cybersecurity engineering, cloud architecture, and DevSecOps prototyping, the role evaluates security controls for AI/LLM technologies across multiple classification levels. The position is based out of Arlington, Virginia, and is suited to a cloud assessor or SCAR experienced in fast-paced DevSecOps environments and AWS cloud security.

Requirements

• U.S. citizen with an active Top Secret security clearance.
• Bachelor's degree and 14 years of relevant experience, or relevant years of experience in lieu of a degree.
• Current DoD 8570/8140 IAM Level II or Level III certification (e.g., Security+, CySA+, CISM, CISSP, CCISO, CAP/CISC).
• 3–5+ years of experience conducting security control assessments, compliance testing, or A&A/RMF activities for DoD or federal information systems.
• Operational understanding of core AWS cloud services, including EC2, S3, IAM, VPCs, Security Groups, and Security Hub, and how security controls function in cloud-native and CI/CD pipeline environments.
• Working knowledge of NIST SP 800-53 (Rev. 4/5), NIST SP 800-37 (RMF), DoD Cloud Computing SRG, and FedRAMP baselines.
• Demonstrated experience writing and evaluating core RMF artifacts, including SSPs, SAPs, SARs, and POA&Ms.
• Exceptional written and verbal communication skills, including the ability to articulate technical risk to executive stakeholders, Authorizing Officials, and engineering teams.
• Hands-on experience navigating government GRC repositories such as eMASS or XACTA.

Nice To Haves

• Experience mapping security controls to the NIST AI Risk Management Framework (AI RMF), OWASP Top 10 for LLM Applications, or DoD Responsible AI (RAI) Guidelines.
• Familiarity evaluating secure design patterns for autonomous AI agents, including tool-calling permissions, sandboxing agent execution environments, prompt boundaries, and ReAct/LangGraph architectures.
• Experience assessing cloud-managed AI ecosystems and foundation model platforms such as AWS Bedrock, AWS SageMaker, Hugging Face Enterprise, or self-hosted open-source models.
• Understanding of data protection, access controls, and boundary security for RAG pipelines and vector databases such as OpenSearch Vector Engine, Pinecone, Milvus, or PostgreSQL pgvector.
• Familiarity evaluating LLM-specific risks, including prompt injection, data poisoning, model inversion, insecure output handling, and open-source supply chain vulnerabilities in AI libraries such as PyTorch, LangChain, and LlamaIndex.
• Exposure to LLM guardrail platforms, evaluation frameworks, or AI security tools such as Promptfoo, Garak, Giskard, and NeMo Guardrails.
• Experience with cATO methodologies, Infrastructure as Code (IaC) templates such as Terraform and CloudFormation, and container security including AWS EKS/ECS and Docker.
• Active AWS certifications, such as AWS Certified Security – Specialty or AWS Certified Solutions Architect.
• Background or familiarity with offensive security and penetration testing.

Responsibilities

• Execute formal SCA/R duties.
• Lead security assessment efforts and establish reusable security playbooks and assessment frameworks for rapid AI deployment into enterprise workflows.
• Evaluate technical control effectiveness across AWS cloud infrastructure, DevSecOps pipelines, microservices, containerized workloads, and GenAI/LLM application stacks.
• Partner with cybersecurity engineering and DevSecOps prototyping teams to integrate security controls early in the development lifecycle.
• Review, author, and maintain System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and POA&Ms tailored to rapid prototyping and AI systems.
• Assess technical security risks specific to AI/LLM implementations, including API exposure, vector database access controls, model integration surface area, and software supply chain dependencies.
• Support continuous monitoring (ConMon), technical risk evaluations, and cloud architecture reviews across multi-tenant, multi-classification environments.
• Coordinate with Authorizing Officials (AOs), program managers, and engineering leads to deliver risk briefings and ATO recommendations.
• Provide technical input and oversight for cybersecurity engineering and penetration testing activities across prototype projects.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior