Offensive Security Control Assessor Representative
Core
Lead security assessment efforts and formal SCA/R duties for high-priority projects involving cybersecurity engineering, cloud architecture, DevSecOps prototyping, and AI/LLM technologies.
Role type
Senior IC Offensive Security Control Assessor
Builds
Reusable security playbooks, assessment frameworks, and custom offensive tooling for mission-ready platforms.
Domain
US Federal Government / Cloud Security / AI/LLM Security
Deliverable
production ML models
Required skills
Security control assessments, compliance testing, A&A/RMF activities, AWS core services (EC2, S3, IAM, VPC, Security Hub), GitLab CI/CD pipeline design, RMF artifact authoring (SSP, SAP, SAR, POA&M), NIST SP 800-53/800-37 knowledge, cloud-native security, CI/CD security, AI/LLM risk assessment, vector database security, RAG pipeline security, supply chain security.
Preferred skills
NIST AI Risk Management Framework mapping, OWASP Top 10 for LLMs, DoD Responsible AI Guidelines, secure design patterns for autonomous AI agents, cloud-managed AI ecosystems (Bedrock, SageMaker), LLM-specific risks (prompt injection, data poisoning), AI security tools (Promptfoo, Garak), cATO methodologies, IaC (Terraform), container security (EKS/ECS, Docker), AWS certifications, offensive security/penetration testing.
Technologies
AWS, GitLab CI/CD, Terraform, Docker, Kubernetes (EKS/ECS), PostgreSQL, OpenSearch, PyTorch, LangGraph, React, AWS Bedrock, AWS SageMaker, Hugging Face, Pinecone, Milvus, Promptfoo, Garak, Giskard, NeMo Guardrails, NIST SP 800-53, NIST SP 800-37, FedRAMP, DoD Cloud Computing SRG, eMASS, XACTA.
Responsibilities
Perform formal SCA/R duties and lead security assessment efforts; Develop reusable security playbooks and assessment frameworks; Evaluate technical control effectiveness across AWS infrastructure, DevSecOps pipelines, microservices, containerized workloads, and GenAI/LLM stacks; Connect offensive security and development teams; Serve as primary SME and lead developer for custom offensive tooling; Review and maintain assessment packages (SSP, SAP, SAR, POA&M); Assess technical risks specific to AI/LLM implementations; Support continuous monitoring and cloud architecture reviews; Coordinate with Authorizing Officials and program managers for risk briefings and ATO recommendations.
Seniority
Senior, hands-on IC
