AI Security Control Assessor (SCA)

SAIC • Arlington, VA

4d • Onsite

About The Position

SAIC is seeking a Security Control Assessor/Representative (SCA/R) to lead security control assessments for high-priority projects involving cybersecurity engineering, cloud architecture, DevSecOps prototyping, and AI/LLM technologies across multiple classification levels. The role is based in Arlington, Virginia, and is suited to a pragmatic cloud assessor or SCAR with AWS cloud security knowledge and experience in fast-paced DevSecOps environments. The assessor will help shape the cybersecurity posture of next-generation DoD AI capabilities.

Requirements

• U.S. citizenship and an active Top Secret security clearance.
• Bachelor's degree, or 14 years of relevant experience in lieu of a degree.
• Current DoD 8570/8140 IAM Level II or Level III certification, such as Security+, CySA+, CISM, CISSP, CCISO, or CAP/CISC.
• 3–5+ years of experience conducting security control assessments, compliance testing, or A&A/RMF activities for DoD or federal information systems.
• Operational understanding of core AWS cloud services, including EC2, S3, IAM, VPCs, Security Groups, and Security Hub, and how security controls function in cloud-native and CI/CD pipeline environments.
• Working knowledge of NIST SP 800-53 (Rev. 4/5), NIST SP 800-37 (RMF), the DoD Cloud Computing SRG, and FedRAMP baselines.
• Demonstrated experience writing and evaluating core RMF artifacts, including SSPs, SAPs, SARs, and POA&Ms.
• Strong written and verbal communication skills, including the ability to explain technical risk to executive stakeholders, Authorizing Officials, and engineering teams.
• Hands-on experience navigating government GRC repositories such as eMASS or XACTA.

Nice To Haves

• Experience mapping security controls to the NIST AI Risk Management Framework (AI RMF), OWASP Top 10 for LLM Applications, or DoD Responsible AI (RAI) Guidelines.
• Familiarity evaluating secure design patterns for autonomous AI agents, including tool-calling permissions, sandboxing agent execution environments, prompt boundaries, and ReAct/LangGraph architectures.
• Experience assessing cloud-managed AI ecosystems and foundation model platforms such as AWS Bedrock, AWS SageMaker, Hugging Face Enterprise, or self-hosted open-source models.
• Understanding of data protection, access controls, and boundary security for RAG pipelines and vector databases such as OpenSearch Vector Engine, Pinecone, Milvus, or PostgreSQL pgvector.
• Familiarity evaluating LLM-specific risks, including prompt injection, data poisoning, model inversion, insecure output handling, and open-source supply chain vulnerabilities in AI libraries such as PyTorch, LangChain, and LlamaIndex.
• Exposure to LLM guardrail platforms, evaluation frameworks, or AI security tools such as Promptfoo, Garak, Giskard, and NeMo Guardrails.
• Experience with cATO methodologies, Infrastructure as Code templates such as Terraform or CloudFormation, and container security using AWS EKS/ECS or Docker.
• Active AWS certifications, such as AWS Certified Security – Specialty or AWS Certified Solutions Architect.
• Background or familiarity with offensive security or penetration testing.

Responsibilities

• Execute formal SCA/R duties.
• Lead security assessment efforts and establish reusable security playbooks and assessment frameworks for rapid AI deployment into enterprise workflows.
• Evaluate technical control effectiveness across AWS cloud infrastructure, DevSecOps pipelines, microservices, containerized workloads, and GenAI/LLM application stacks.
• Partner with cybersecurity engineering and DevSecOps prototyping teams to integrate security controls early in the development lifecycle.
• Review, author, and maintain assessment packages, including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and POA&Ms, tailored to rapid prototyping and AI systems.
• Assess technical security risks specific to AI/LLM implementations, including API exposure, vector database access controls, model integration surface area, and software supply chain dependencies.
• Support continuous monitoring (ConMon), technical risk evaluations, and cloud architecture reviews across multi-tenant, multi-classification environments.
• Coordinate with Authorizing Officials (AOs), program managers, and engineering leads to deliver decision-ready risk briefings and ATO recommendations.
• Provide technical input and oversight for cybersecurity engineering and penetration testing activities across prototype projects.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level