# Offensive Security Control Assessor Security Control Assessor Representative at Dark Wolf Solutions

> United States · Unspecified · Security · open. Source: https://alderhq.app/jobs/greenhouse%3Adarkwolfsolutions%3A7871384003 (read 2026-11-05).

## Facts (observed)

- Company: [Dark Wolf Solutions](https://alderhq.app/companies/dark-wolf-solutions)
- Location text: Washington DC Metro Area; Herndon, VA
- Where it can be done from (inferred): United States (evidence: "Location: Washington DC Metro Area; Herndon, VA")
- Posted: 2026-08-14 (83 days ago)
- First seen by alder: 2026-11-02 · last verified: 2026-11-04
- Reposted: 0 times · edited: 0 times
- Apply on the employer's site: https://job-boards.greenhouse.io/darkwolfsolutions/jobs/7871384003
- Skills listed (inferred): React, AWS, LLMs, Distributed systems

## Pay and sponsorship

- Posted pay: not posted
- Market band for similar posted roles (Washington DC, n 61): p25 $107k, median $126k, p75 $150k

## Description (the employer's text)

Dark Wolf Solutions is seeking Security Control Assessor/Representatives (SCA/Rs) to lead security control assessments across high-priority projects. Working at the intersection of cybersecurity engineering, cloud architecture, and DevSecOps prototyping, you will evaluate security controls for cutting-edge AI/LLM technologies across multiple classification levels. This position is ideal for a pragmatic cloud assessor or SCAR who excels in fast-paced DevSecOps environments, understands AWS cloud security, and is eager to shape the cybersecurity posture of next-generation DoD AI capabilities.This position will be based out of Arlington, VA with hybrid/remote opportunities. Additional responsibilities include:

### Key Responsibilities

- Execute formal SCA/R duties.
- Lead security assessment efforts, establishing reusable security playbooks and assessment frameworks for rapid AI deployment into enterprise workflows.
- Evaluate technical control effectiveness across AWS cloud infrastructure, DevSecOps pipelines, microservices, containerized workloads, and GenAI/LLM application stacks.
- Bridge the gap between OffSec and development by applying software design best practices. Lead technical exchange meetings (TEMs), participate in Discovery & Framing workshops, and maintain effective communication with cross-functional teams and stakeholders.
- Act as the primary subject matter expert and lead developer for custom offensive tooling, integrating disparate capabilities into a cohesive, mission-ready platform.
- Review, author, and maintain assessment packages—including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and POA&Ms—tailored to rapid prototyping and AI systems.
- Assess technical security risks specific to AI/LLM implementations, such as API exposure, vector database access controls, model integration surface area, and software supply chain dependencies.
- Support continuous monitoring (ConMon), technical risk evaluations, and cloud architecture reviews across multi-tenant, multi-classification environments.
- Coordinate with Authorizing Officials (AOs), program managers, and engineering leads to deliver decision-ready risk briefings and ATO recommendations.
- Provide technical input and oversight for cybersecurity engineering and penetration testing activities across prototype projects.
### Required Qualifications

- Active Top Secret security clearance
- Current DoD 8570/8140 IAM Level II or Level III certification (e.g., Security+, CySA+, CISM, CISSP, CCISO, CAP/CISC)
- 5–7+ years of experience conducting security control assessments, compliance testing, or A&A/RMF activities for DoD or federal information systems
- Solid operational understanding of core AWS cloud services (EC2, S3, IAM, VPCs, Security Groups, Security Hub) and how security controls function within cloud-native and CI/CD pipeline environments.
- Experience with GitLab CI/CD (pipeline design, runners, artifact management) and AWS Cloud services (EC2, VPC, IAM, S3).
- Strong working knowledge of NIST SP 800-53 (Rev. 4/5), NIST SP 800-37 (RMF), DoD Cloud Computing SRG, and FedRAMP baselines.
- Demonstrated experience writing and evaluating core RMF artifacts (SSPs, SAPs, SARs, POA&Ms)
- Exceptional written and verbal communication skills, with the ability to articulate technical risk clearly to executive stakeholders, Authorizing Officials, and engineering teams.
- Hands-on experience navigating government GRC repositories, such as eMASS or XACTA.
### Desired Qualifications

- Hands-on experience mapping security controls to the NIST AI Risk Management Framework (AI RMF), the OWASP Top 10 for LLM Applications, or the DoD Responsible AI (RAI) Guidelines.
- Familiarity evaluating secure design patterns for autonomous AI Agents (e.g., tool-calling permissions, sandboxing agent execution environments, prompt boundaries, and ReAct/LangGraph architectures).
- Experience assessing cloud-managed AI ecosystems and foundation model platforms (e.g., AWS Bedrock, AWS SageMaker, Hugging Face Enterprise, or self-hosted open-source models).

---
Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/greenhouse%3Adarkwolfsolutions%3A7871384003 and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.