43 jobs found

Job Description Job Description About Us AGE Solutions is a premier technology and professional services company, providing in-depth consulting, advanced technology solutions, and essential services throughout the U.S. government, defense, and intelligence sectors. Prioritizing innovation and client-focused solutions, we assist major agencies in addressing intricate issues and ensuring a more secure future. AGE Solutions is looking for a Security Control Assessor, Intermediate to join our team in support of a cybersecurity risk management and assessment program with our DoD customer. Responsibilities Include: Conduct cybersecurity assessments, audits, and inspections for DoD organizations and partners handling DoD information or connecting to the DoDIN. Evaluate systems and Defensive Cyberspace Operations using cyber threat emulation and performance-based testing. Adhere to policies and processes for each assessment type. Support assessment development and execution to ensure security expertise is properly applied. Coordinate logistics, test plans, and scope with the SCA Team Lead. Perform vulnerability assessments, capture results using STIG Viewer or designated tools, and document findings in eMASS. Analyze security gaps and provide mitigation recommendations. Validate cybersecurity controls, TTPs, STIGs, RMF controls, and compliance with DoD policies and guidelines. Provide risk analysis and assessment results for authorization recommendations. Participate in daily assessment reviews, in-briefs, and out-briefs, sharing findings with the SCA-R. Requirements: Bachelor's degree (IT-related field preferred) Five (5) years of overall experience in cybersecurity or network security position Three (3) years of experience in a Certification and Accreditation/A&A role Must have and maintain an active DoD Top Secret clearance with SCI eligibility DoD 8570 IA Technical (IAT) Level II certification Demonstrated experience with STIGs (Security Technical Implementation Guides), Security Requirement Guides (SRGs), Plan of Action and Milestones (POA&Ms) and cybersecurity best practices Strong understanding of the RMF process, NIST SP 800- 37, NIST SP 800-53, CNSSI 1253 Demonstrated experience with relevant tools such as eMASS, STIG Viewer, Nessus, ACAS, SCAP, or HBSS Demonstratable understanding of key technologies areas/domain such as: Network, Mobility, Windows, UNIX, Cloud Environments and Cloud Native Tools/Services, Host Based Security System (HBSS)/Endpoint Security Solutions (ESS), Databases, Applications Strong written and verbal communication skills for reporting assessment findings. Location: This is a remote role requiring approximately 85% travel, both CONUS and OCONUS. Candidates must possess a valid U.S. Passport or have the ability to obtain one in a timely manner. Strong preference will be given to candidates who currently reside in the DMV (Washington, DC, Maryland, Virginia) region or Pennsylvania, or who are willing to relocate to one of these areas to support customer requirements and team collaboration activities. The projected salary range for this position is $70,000+ annually. Final compensation will be determined based on factors including years of relevant experience, active security clearance level, certifications, technical skillset, contract requirements, and overall qualifications. At AGE Solutions, we reward performance, invest in growth, and share success. Our benefits support the whole person, professionally, financially, and personally. 26 Days Paid Leave: Includes vacation, sick, personal time, and holidays. You choose how to use it. Performance Bonuses: Performance bonuses are awarded based on individual contributions and company-wide results, aligning recognition with impact. 401(k) with Match: We match 3% of your contributions with immediate vesting. Financial Protection: Company-paid life insurance up to $300K and options for additional coverage for you and your dependents. Health Benefits: Multiple medical plans, dental, vision, FSA and HSA options to fit your needs. Parental Leave: 15 days of fully paid leave for new parents, because family matters. Military Differential Pay: We bridge the gap for employees on active duty, so they don't take a financial hit while serving. Professional Growth: Paid training and certifications, tuition reimbursement, and the tools and tech to get the job done right. Shared Success: In the event of a company sale, our CEO has committed to returning 80% of net proceeds to employees. This ensures our team shares in the long term value they help create. At AGE, you'll do work that matters, supported by a company that delivers for its people.

Job Description Job Description About Us AGE Solutions is a premier technology and professional services company, providing in-depth consulting, advanced technology solutions, and essential services throughout the U.S. government, defense, and intelligence sectors. Prioritizing innovation and client-focused solutions, we assist major agencies in addressing intricate issues and ensuring a more secure future. AGE Solutions is looking for a Cloud SCA-R, Mid, to join our team in support of a cybersecurity risk management and assessment program with our DoD customer. In this role, you will be part of a team responsible for performing analysis, conducting independent validations of assessments, and Continuous Monitoring (ConMon) for authorized CSPs and CSOs. Individuals in this role must be available to work full-time on-site at Ft. Meade, MD. Essential Duties and Responsibilities Include: Conduct cybersecurity assessments and validations of Cloud Service Offerings (CSOs) in support of the DoD Provisional Authorization (PA) process Prepare 30 Cloud Security Assessment Packages per year, including validated cybersecurity controls, certifier's recommendations, and residual risk statements Review Cloud Service Provider (CSP) documentation packages, including architectural diagrams, System Security Plans (SSP) with Addendums, Readiness Assessment Reports (RAR), Security Assessment Plans (SAP), and Security Assessment Reports (SAR) Evaluate supporting materials such as POA&Ms, Change Requests, Extension and Deviation Requests, Whitelist Requests, Corrective Action Plans, and applicable templates, checklists, and Continuous Monitoring (ConMon) artifacts Attend technical kickoff meetings to evaluate and document the CSP's security posture and readiness for assessment Analyze and provide feedback on assessment documentation, including the RAR, SAP, SSP, and system architecture diagrams Identify and document the operational impact of security authorizations, changes, or identified vulnerabilities within the CSP's environment Develop complete Cloud Security Assessment Packages in accordance with DoD standards, ensuring inclusion of SARs, POA&Ms, and Deviation Requests Create authorization recommendation memorandums summarizing compliance with DoD cybersecurity controls, technical evaluation results, and residual risk considerations Draft DoD PA memorandums outlining CSO boundary definitions, service offerings, authorization duration, terms and conditions, DoD usage considerations, and follow-on actions Validate implementation of CSO controls within eMASS or a government-provided GRC platform, and log assessment completion in the Mission Security Review (MSR) Review the Customer Responsibility Matrix (CRM) and ensure correct inheritance mapping within eMASS or the designated GRC tool Enter all authorization conditions into eMASS as system-level POA&Ms and monitor for timely resolution Upload and associate all CSP documentation with applicable security controls in eMASS or the appropriate system of record Track and manage all CSO-related data using the Team Lead Resource (TLR) Assessment Database Maintain and update the DoD Cloud Process Guide and associated templates, forms, checklists, and documentation Contribute to the development of internal instructions, how-to guides, and reference material to support consistent assessor workflows Ensure assessment activities are conducted in compliance with DoDI 8510.01 and the DoD Cloud Computing Security Requirements Guide (SRG) Document assessment methodologies and validation best practices to continuously improve assessment accuracy, consistency, and process efficiency Support the ongoing development and annual updates of the DoD Cloud Assessment Process Guides in alignment with evolving policy and government directives Required Qualifications: Education: Bachelor's degree (IT-related field preferred) Experience: Five (5) years of overall experience in cybersecurity or network security position Security Clearance: Must have an active DoD Top Secret clearance with SCI eligibility Certifications: DoD 8570 IAM/IA Technical (IAT) Level II certification Skills and Knowledge: Working knowledge of DoD Risk Management Framework (RMF) and DoDI 8510.01 Familiarity with the DoD Cloud Computing Security Requirements Guide (SRG) and associated cloud security policies Familiarity with security controls for Azure, AWS, and assorted cloud platforms Experience conducting security assessments and developing security documentation (e.g., SSP, SAR, POA&M, SAP) Proficiency with eMASS or equivalent Government Risk and Compliance (GRC) tools Demonstrated ability to interpret and apply NIST SP 800-53 security controls in cloud environments Strong analytical and technical writing skills with the ability to communicate complex topics clearly Location: Applicants must reside within a commutable distance of Ft. Meade, MD in order to work onsite full time. The projected salary range for this position is $100,000+ annually. Final compensation will be determined based on factors including years of relevant experience, active security clearance level, certifications, technical skillset, contract requirements, and overall qualifications. At AGE Solutions, we reward performance, invest in growth, and share success. Our benefits support the whole person, professionally, financially, and personally. 26 Days Paid Leave: Includes vacation, sick, personal time, and holidays. You choose how to use it. Performance Bonuses: Performance bonuses are awarded based on individual contributions and company-wide results, aligning recognition with impact. 401(k) with Match: We match 3% of your contributions with immediate vesting. Financial Protection: Company-paid life insurance up to $300K and options for additional coverage for you and your dependents. Health Benefits: Multiple medical plans, dental, vision, FSA and HSA options to fit your needs. Parental Leave: 15 days of fully paid leave for new parents, because family matters. Military Differential Pay: We bridge the gap for employees on active duty, so they don't take a financial hit while serving. Professional Growth: Paid training and certifications, tuition reimbursement, and the tools and tech to get the job done right. Shared Success: In the event of a company sale, our CEO has committed to returning 80% of net proceeds to employees. This ensures our team shares in the long term value they help create. At AGE, you'll do work that matters, supported by a company that delivers for its people.

Job Description Job Description Job Title: Security Control Assessor Location: On Site in Arlington, VA Department: Cyber Security Services Reports To: Management FLSA Status: Full Time/Non-exempt Clearance: Top Secret clearance with the ability to obtain SCI with CI Polygraph Job Purpose: The security control assessor (SCAs) supports a critical, objective role to evaluate the effectiveness of implemented controls in mitigating security risks. The SCA will support a critical mission within the intelligence community. In the role as a SCA, you are expected to use automated scanning tools, manual techniques, and specialized testing methodologies to identify weaknesses and vulnerabilities. The SCA is expected to be a collaborative member of the RMF program of the organization, to provide intelligent input to system security architectures in order to align with RMF principles and guidelines. This includes ensuring to guide the RMF process so that security controls are integrated seamlessly into system designs to provide comprehensive protection against threats and vulnerabilities. Duties & Responsibilities: The SCA's specific duties include: Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Ensure security assessments are completed for each IS. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the CISO and AO under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop the continuous monitoring plan specific to the information system. The SCA is responsible for the RMF deliverables associated with Step 4 of DOD and IC RMF Policies for assigned systems. This includes, but is not limited to: Security Assessment Plans tailored to specific systems control requirements Security control assessment input, which includes narratives for the review of controls and artifacts Security Assessment Reports ATO recommendations or ATO with Condition Memorandums Conduct initial remediation actions once a security assessment has been completed to ensure proper hand off to the ISSM and ISSOs. Assessment of selected controls IAW continuous monitoring strategy The SCA is expected to have additional duties as assigned in support of corporate cyber security services. Additional details are reviewed in accordance with company policies. Requirements Required Skills & Experience: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings Qualifications: Bachelor's Degree in Computer Science or a related technical discipline Master's Degree preferred. Minimum 6-10 years of experience. Must currently possess an active Top Secret clearance with the ability to obtain SCI with CI Polygraph. DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) is required Systems Security Engineering background preferred. Effective communication skills to collaborate with cross-functional teams and stakeholders on implementing security measures organization-wide. Strong analytical skills for identifying system vulnerabilities and documenting control remediation recommendations through collaboration on System Impact Analysis and Documented Risk Acceptance. Detail-oriented with the ability to manage multiple tasks and prioritize effectively. Comprehensive knowledge of RMF activities at a senior level (ability to articulate to Executive audiences preferred). Familiarity with federal regulatory requirements, contractual obligations, and industry standards related to information security. Evaluate adherence to standards such as Privacy, GDPR, and HIPAA Powered by JazzHR I48iVzr4Ds

Job Description Job Description Job Summary Newberry Group seeks a Jr. Security Control Assessor to support its Government Client. This role requires 85% travel to various government locations both domestically and internationally. Location Hybrid position - approx. 25% remote support with up to 75% CONUS and OCONUS travel. Clearance Active DoD Top Secret Clearance required. Certifications DoD 8570 IAT II (active or will obtain within 90 days of hire) Contingencies If an opening is not currently available, candidates applying to this role will be placed in our pipeline for future openings within this contract's program. Compensation $50,000 - $70,000 Primary Responsibilities: Conduct cybersecurity assessments, audits, and inspections for DoD organizations and partners handling DoD information or connecting to the DoDIN. Evaluate systems and Defensive Cyberspace Operations using cyber threat emulation and performance-based testing. Adhere to policies and processes for each assessment type. Support assessment development and execution to ensure security expertise is properly applied. Coordinate logistics, test plans, and scope with the SCA Team Lead. Perform vulnerability assessments, capture results using STIG Viewer or designated tools, and document findings in eMASS. Analyze security gaps and provide mitigation recommendations. Validate cybersecurity controls, TTPs, STIGs, RMF controls, and compliance with DoD policies and guidelines. Provide risk analysis and assessment results for authorization recommendations. Participate in daily assessment reviews, in-briefs, and out-briefs, sharing findings with the SCA-R. For each RMF Review, the assessors shall perform the following: The candidate will be required to review applicable controls to determine compliance status and enter all test results into the designated repository (Enterprise Mission Assurance Support Service (eMASS) Providing key assessment results to the team lead to include the number of controls reviewed and risk/residual information for inclusion in the authorization recommendation. The candidate will be required to be certified via the ACP IAW the ACP CONOPS before conducting any assessments. The candidate must be certified in a minimum of two (2) technologies and RMF Control Validation before conducting any assessments. Training through the DISA program will be provided after hire and consist of at least 3 months. The contractor shall maintain active accounts to the tools and systems required to perform risk assessments. The candidate will be required to participate in the in-brief and out-brief of each assessment. Qualifications: Bachelor's degree in a related area of study (i.e. Security, Information Technology). 0-1 year of experience required. Willing to train on both technologies and RMF. Active DoD Top Secret clearance with SCI eligibility is preferred but can begin with a secret clearance. IAT Level II certification active or will obtain within 90 days of hire. CompTIA Cybersecurity Analyst (CySA+) CompTIA Security. EC-Council Certified Network Defense (CND) v3. Red Hat Certified System Administrator (RHCSA) CCNA Security. Global Industrial Cyber Security Professional (GICSP) GIAC Security Essentials (GSEC) Systems Security Certified Practitioner (SSCP) Familiarity with STIGs (Security Technical Implementation Guides), Security Requirement Guides (SRGs), Plan of Action and Milestones (POA&Ms) and cybersecurity best practices desired. Understanding of the RMF process, NIST SP 800- 37, NIST SP 800-53, CNSSI 1253 desired Familiarity with relevant tools such as eMASS, STIG Viewer, Nessus, ACAS, SCAP, or HBSS desired Strong written and verbal communication skills for reporting assessment findings. Who We Are Today's leading government agencies are putting their trust in Newberry Group, and for good reason. Newberry brings strength to our clients, from the inside out, through: • client intimacy and superior quality, • presence and accountability in our relationships, and • Public sector best practices. Newberry Group is a professional services firm, providing information security compliance, governance, program/project management, and mission-critical project-based consulting to public sector clients nationwide. The strength of our company is a direct reflection of our highly skilled and talented workforce. Benefits and Perks In addition to competitive wages, Newberry Group offers an outstanding benefit package. This includes medical coverage with three plan options, dental and vision coverage, personal time off, paid holidays, paid parental leave, telecommuting if available, retirement savings accounts (Pre-Tax and Roth), flexible and dependent care savings accounts, life insurance, long and short-term disability coverage, tuition and training reimbursement, employee assistance program, and more. The Newberry Group, Inc. is an Equal Opportunity Employer - EEO/AA/Disability/Veterans. Powered by JazzHR 5whc8Lvtfu

Job Description Job Description Cloud Security Architect - IL4 / Workday (U.S. Space Force) Job Level: Senior Employment Type: Full-Time Clearance: U.S. citizenship required Salary Range: $150,000-$200,000 annually Location: Primary site is Washington, DC metropolitan area. Candidates may also be based near Buckley, Los Angeles, Patrick, Peterson, Schriever, or Vandenberg Space Force Base. Work Arrangement: Hybrid, occasional onsite at a government or MPX site may be required Contract Status: SBIR Phase II effort with a planned pathway to a production program of record; current period of performance through contract award. The Opportunity We are seeking a Cloud Security Architect to design, secure, and support the cloud architecture behind U.S. Space Force human capital management (HCM) modernization, the system that manages several factors such as personal, promotion, and assignment for USSF Guardians. The position initially supports a Workday-based Small Business Innovation Research (SBIR) Phase II effort and is expected to contribute to the transition toward a production program of record, subject to program award and customer requirements. Reporting to the Program Manager, you will work with a team across cloud engineering, cybersecurity, identity management, enterprise integration, and Risk Management Framework (RMF) to deliver a secure, scalable architecture capable of supporting Department of War Impact Level 4 (IL4) requirements and successful authorization. Primary Responsibilities Design and document secure cloud architectures for IL4 hosting in AWS GovCloud, covering identity and access management, encryption, network security, boundary protection, and monitoring. Develop secure integration patterns between Workday and third-party SaaS, including identity federation with CAC/PKI and DoD ICAM, APIs, data exchange, and zero trust controls. Design IL4 network connectivity through the required Cloud Access Point (CAP) and align monitoring and incident response with the program's Cybersecurity Service Provider (CSSP). Partner with the RMF lead to implement and document NIST SP 800-53 controls in eMASS, apply applicable STIGs and SRGs, prepare authorization evidence, support assessors, and remediate technical findings. Evaluate the SBIR architecture against production requirements and develop scalable, supportable designs for the anticipated HCM program of record. Collaborate with the architects, platform engineers, cybersecurity specialists, subcontractors, and government technical authorities. Apply approved AI and automation tools to improve architecture analysis, configuration validation, security documentation, and engineering efficiency, while keeping CUI and other sensitive data within approved boundaries and validating all technical outputs. Requirements Required Qualifications 7+ years of cloud architecture, cybersecurity architecture, or secure enterprise systems engineering experience. Direct experience designing or securing Department of War (DoW) IL4/IL5 or FedRAMP High environments. Hands-on experience with RMF and Authority to Operate (ATO) processes, including control implementation, documentation in eMASS, and assessor support. Hands-on experience with identity federation (including CAC/PKI or PIV-based authentication), zero trust architecture, encryption, network security, and SaaS integrations. Experience designing secure APIs, enterprise integrations, and data exchange architectures. Ability to document technical decisions, communicate architecture risks, and collaborate across engineering and security teams. U.S. citizenship. Preferred Qualifications Experience integrating Workday or another enterprise human capital management platform. Experience supporting U.S. Space Force or Department of the Air Force modernization programs. Familiarity with the DoW Cloud Computing Security Requirements Guide (CC SRG), NIST SP 800-53, and applicable DISA STIGs and SRGs. Cloud architecture or security certifications (e.g., AWS or Azure architect or security credentials), or equivalent demonstrated expertise. Experience transitioning SBIR, prototype, or pilot capabilities into production government environments. Experience with AWS GovCloud or Azure Government, Cloud Access Point (CAP) connectivity, and CSSP onboarding. DoD 8140 qualification at the required level (e.g., CISSP or CCSP), or the ability to obtain it within 6 months of hire. Benefits Benefits Annual Base Salary: $150,000-$200,000, depending on experience, qualifications, and assigned responsibilities. Full-time employees are eligible for: Medical, dental, and vision coverage. Company-provided disability and life insurance. 401(k) retirement plan. Paid federal holidays. Paid time off (PTO). Benefits are subject to applicable plan terms and company policies. Our Client's Culture Our client is an AI-first mission technology company and Original Equipment Manufacturer (OEM) focused on delivering operationally ready technologies for the Department of War, Intelligence Community, and broader U.S. Government. Through a collaborative Team of Teams approach, the organization brings together mission experts, technology partners, subcontractors, and government stakeholders to generate decision advantage for missions of consequence. Its culture emphasizes: Mission-First Execution: Delivering measurable outcomes that support critical government missions. Integrity & Ownership: Demonstrating accountability, professionalism, and disciplined execution. Collaboration & Communication: Promoting candid communication and effective teamwork. Technical Excellence: Maintaining high standards through continuous improvement and innovation. Responsible AI: Advancing mission capabilities through secure and responsible technology adoption. Equal Employment Opportunity Our client is an Equal Opportunity Employer. Qualified applicants will be considered without regard to race, color, religion, sex, national origin, age, disability, protected veteran status, or any other status protected by applicable law. This position requires U.S. citizenship, an active Top Secret clearance, and eligibility for SCI access in accordance with applicable contract and customer requirements.

Job Description Job Description Cloud Security Architect - IL4 / Workday (U.S. Space Force) Job Level: Senior Employment Type: Full-Time Clearance: U.S. citizenship required Salary Range: $150,000-$200,000 annually Location: Primary site is Washington, DC metropolitan area. Candidates may also be based near Buckley, Los Angeles, Patrick, Peterson, Schriever, or Vandenberg Space Force Base. Work Arrangement: Hybrid, occasional onsite at a government or MPX site may be required Contract Status: SBIR Phase II effort with a planned pathway to a production program of record; current period of performance through contract award. The Opportunity We are seeking a Cloud Security Architect to design, secure, and support the cloud architecture behind U.S. Space Force human capital management (HCM) modernization, the system that manages several factors such as personal, promotion, and assignment for USSF Guardians. The position initially supports a Workday-based Small Business Innovation Research (SBIR) Phase II effort and is expected to contribute to the transition toward a production program of record, subject to program award and customer requirements. Reporting to the Program Manager, you will work with a team across cloud engineering, cybersecurity, identity management, enterprise integration, and Risk Management Framework (RMF) to deliver a secure, scalable architecture capable of supporting Department of War Impact Level 4 (IL4) requirements and successful authorization. Primary Responsibilities Design and document secure cloud architectures for IL4 hosting in AWS GovCloud, covering identity and access management, encryption, network security, boundary protection, and monitoring. Develop secure integration patterns between Workday and third-party SaaS, including identity federation with CAC/PKI and DoD ICAM, APIs, data exchange, and zero trust controls. Design IL4 network connectivity through the required Cloud Access Point (CAP) and align monitoring and incident response with the program's Cybersecurity Service Provider (CSSP). Partner with the RMF lead to implement and document NIST SP 800-53 controls in eMASS, apply applicable STIGs and SRGs, prepare authorization evidence, support assessors, and remediate technical findings. Evaluate the SBIR architecture against production requirements and develop scalable, supportable designs for the anticipated HCM program of record. Collaborate with the architects, platform engineers, cybersecurity specialists, subcontractors, and government technical authorities. Apply approved AI and automation tools to improve architecture analysis, configuration validation, security documentation, and engineering efficiency, while keeping CUI and other sensitive data within approved boundaries and validating all technical outputs. Requirements Required Qualifications 7+ years of cloud architecture, cybersecurity architecture, or secure enterprise systems engineering experience. Direct experience designing or securing Department of War (DoW) IL4/IL5 or FedRAMP High environments. Hands-on experience with RMF and Authority to Operate (ATO) processes, including control implementation, documentation in eMASS, and assessor support. Hands-on experience with identity federation (including CAC/PKI or PIV-based authentication), zero trust architecture, encryption, network security, and SaaS integrations. Experience designing secure APIs, enterprise integrations, and data exchange architectures. Ability to document technical decisions, communicate architecture risks, and collaborate across engineering and security teams. U.S. citizenship. Preferred Qualifications Experience integrating Workday or another enterprise human capital management platform. Experience supporting U.S. Space Force or Department of the Air Force modernization programs. Familiarity with the DoW Cloud Computing Security Requirements Guide (CC SRG), NIST SP 800-53, and applicable DISA STIGs and SRGs. Cloud architecture or security certifications (e.g., AWS or Azure architect or security credentials), or equivalent demonstrated expertise. Experience transitioning SBIR, prototype, or pilot capabilities into production government environments. Experience with AWS GovCloud or Azure Government, Cloud Access Point (CAP) connectivity, and CSSP onboarding. DoD 8140 qualification at the required level (e.g., CISSP or CCSP), or the ability to obtain it within 6 months of hire. Benefits Benefits Annual Base Salary: $150,000-$200,000, depending on experience, qualifications, and assigned responsibilities. Full-time employees are eligible for: Medical, dental, and vision coverage. Company-provided disability and life insurance. 401(k) retirement plan. Paid federal holidays. Paid time off (PTO). Benefits are subject to applicable plan terms and company policies. Our Client's Culture Our client is an AI-first mission technology company and Original Equipment Manufacturer (OEM) focused on delivering operationally ready technologies for the Department of War, Intelligence Community, and broader U.S. Government. Through a collaborative Team of Teams approach, the organization brings together mission experts, technology partners, subcontractors, and government stakeholders to generate decision advantage for missions of consequence. Its culture emphasizes: Mission-First Execution: Delivering measurable outcomes that support critical government missions. Integrity & Ownership: Demonstrating accountability, professionalism, and disciplined execution. Collaboration & Communication: Promoting candid communication and effective teamwork. Technical Excellence: Maintaining high standards through continuous improvement and innovation. Responsible AI: Advancing mission capabilities through secure and responsible technology adoption. Equal Employment Opportunity Our client is an Equal Opportunity Employer. Qualified applicants will be considered without regard to race, color, religion, sex, national origin, age, disability, protected veteran status, or any other status protected by applicable law. This position requires U.S. citizenship, an active Top Secret clearance, and eligibility for SCI access in accordance with applicable contract and customer requirements.

Job Description Job Description TechOp Solutions International is seeking a Privacy Analyst to support DHS' privacy compliance and information-governance. The Privacy Analyst will work with privacy officials, system owners, cybersecurity personnel, program offices, and other stakeholders to assess systems and data practices, document privacy requirements, and support the development and maintenance of federal privacy compliance artifacts. Key Responsibilities Support the preparation, review, and maintenance of Privacy Threshold Analyses (PTAs), Privacy Impact Assessments (PIAs), System of Records Notices (SORNs), and related privacy documentation. Identify and document the collection, use, maintenance, sharing, retention, and disposal of personally identifiable information. Translate technical and operational information into clear, accurate privacy compliance documentation. Review privacy documentation for completeness, consistency, accuracy, and compliance with applicable federal and departmental requirements. Identify potential privacy risks and assist stakeholders in documenting appropriate mitigation measures. Maintain accurate assessment records, status reports, trackers, and supporting documentation. Handle sensitive information with accuracy, discretion, and confidentiality. Requirements Bachelor's degree in cybersecurity, information systems, information technology, public policy, legal studies, business, or a related field. Relevant experience may be considered in place of a degree. At least two years of experience supporting one or more of the following areas: Privacy compliance Information governance Cybersecurity governance, risk, and compliance Risk Management Framework or authorization activities Information-system security Experience gathering, analyzing, and documenting technical or operational requirements. Understanding of personally identifiable information(PII), data flows, access controls, information sharing, retention, and privacy risk. Strong analytical, research, writing, editing, and organizational skills. Ability to manage multiple assessments and documentation requirements simultaneously. U.S. citizenship and ability to satisfy applicable federal background investigation, suitability, or security requirements. Preferred Qualifications Direct experience preparing or reviewing PTAs, PIAs, SORNs, or similar federal privacy compliance artifacts. Experience supporting the Department of Homeland Security. Experience with the NIST Risk Management Framework and NIST SP 800-53 security and privacy controls. Previous experience as a privacy analyst, system analyst, ISSO, security control assessor, RMF analyst, or federal GRC analyst. Knowledge of the Privacy Act of 1974, E-Government Act privacy requirements, Fair Information Practice Principles, and federal privacy policy.

Job Description Job Description About Us AGE Solutions is a premier technology and professional services company, providing in-depth consulting, advanced technology solutions, and essential services throughout the U.S. government, defense, and intelligence sectors. Prioritizing innovation and client-focused solutions, we assist major agencies in addressing intricate issues and ensuring a more secure future. The Security Control Assessor Representative (SCA-R) provides cybersecurity assessment, Risk Management Framework (RMF), and Assessment and Authorization (A&A) support for Department of Defense (DoD) information systems. The SCA-R works with Information System Security Managers (ISSMs), Program Management Offices (PMOs), system owners, technical teams, and Government cybersecurity stakeholders to assess security controls, identify cybersecurity risks, validate system compliance, and support authorization decisions throughout the system lifecycle. The SCA-R performs independent technical and risk-based assessments using Government-approved processes, databases, and cybersecurity tools and develops complete, accurate, and defensible authorization documentation for Government and Authorizing Official (AO) review. Responsibilities Include: Use Government-assigned tools and databases to perform weekly updates, maintain system records, track assigned actions, and complete cybersecurity assessment and authorization activities. Coordinate with ISSMs, PMOs, system owners, and technical stakeholders to understand system architectures, security requirements, authorization boundaries, configurations, and system changes. Conduct risk analysis, security control assessment, and authorization activities across applicable RMF steps using approved RE5 tools and processes. Verify system authorization boundaries and validate system security categorizations in accordance with FIPS 199 and applicable DoD requirements. Identify applicable data classifications and conduct system-level cybersecurity risk assessments. Assess threats, vulnerabilities, control deficiencies, and residual risks and compile findings into complete and accurate authorization packages. Evaluate proposed and implemented system changes, determine their potential security and authorization impacts, and provide appropriate status and risk information to the Authorizing Official (AO). Evaluate authorization and change requests, including web-filtering requests, firewall exceptions, ports and protocols, cybersecurity risks, STIG/SRG compliance, and on-site security requirements. Review and validate compliance with applicable Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), security controls, and cybersecurity requirements. Review, validate, and track Plans of Action and Milestones (POA&Ms) and associated cybersecurity deficiencies through resolution. Lead and support on-site assessment visits, including planning, technical assessments, stakeholder coordination, entrance/exit briefings, documentation, findings development, and reporting. Maintain access to and proficiency with required Government cybersecurity databases, vulnerability assessment platforms, endpoint security solutions, scanning tools, and RMF management systems. Attend required Government meetings, technical exchanges, and training to remain current with policies, procedures, tools, and RMF process changes. Complete required assessor, vulnerability scanning, endpoint security, and RMF process training. Support assigned systems throughout their lifecycle in accordance with FISMA, DoD RMF, and applicable cybersecurity requirements. Prepare and submit weekly activity reports documenting completed and ongoing activities, tracking identifiers, assessment status, significant findings, risks, issues, and key updates. Independently assess security control deficiencies and residual risks, evaluate alternative corrective actions, and recommend risk-based remediation priorities. Advise the Authorizing Official and Government cybersecurity stakeholders on the security risks and operational implications of system changes, exception requests, and authorization decisions. Required Skills, Qualifications and Experience: Education: Bachelor's degree required. A bachelor's in information technology, Cybersecurity, Computer Science, Information Systems, or related technical field is preferred. Overall Experience: Minimum of eight (8) years of experience in a cybersecurity or network security position. A&A Experience: Minimum of five (5) years of experience performing Certification and Accreditation (C&A) and/or Assessment and Authorization (A&A) activities. Security Clearance: Active DoD Top Secret clearance with Sensitive Compartmented Information (SCI) eligibility. Certification: Current DoD 8570 IAM Level III certification. Skills: Demonstrated experience serving as a Security Control Assessor Representative (SCA-R) and performing cybersecurity risk analysis and security control validation. Advanced understanding and practical application of the Risk Management Framework (RMF), including NIST SP 800-37, NIST SP 800-53, and CNSSI 1253. Demonstrated experience applying and evaluating Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), Plans of Action and Milestones (POA&Ms), cybersecurity security controls, and industry/DoD cybersecurity best practices. Demonstrated hands-on experience with relevant cybersecurity and RMF tools, including one or more of the following: eMASS, STIG Viewer, Nessus, ACAS, SCAP, and HBSS/Endpoint Security Solutions (ESS). Advanced understanding of multiple cybersecurity technology areas and domains, including network technologies and security, mobility, Windows, UNIX/Linux, cloud environments, cloud-native tools and services, HBSS/Endpoint Security Solutions (ESS), databases, and applications. Strong customer service and stakeholder engagement skills, with the ability to effectively coordinate with Government customers, ISSMs, PMOs, technical teams, system owners, and cybersecurity leadership. Ability to analyze complex technical and cybersecurity information and clearly communicate security risks, vulnerabilities, assessment findings, residual risk, and recommended corrective actions through written documentation and technical briefings. Location and Schedule: This role may be based at one of the following customer locations, with onsite requirements varying by location: Chambersburg, PA: Fully onsite, 5 days per week. Arlington, VA or Fort Meade, MD: Hybrid schedule, 4 days onsite per week with 1 telework day. Travel Requirements: Must be willing and able to support occasional domestic (CONUS) and international (OCONUS) travel, approximately 10% of the time. Work Environment and Physical Demand: Must be able to sit at a desk throughout the day and be able to visit customers within their office on a daily basis. The projected salary range for this position is $100,000+ annually. Final compensation will be determined based on factors including years of relevant experience, active security clearance level, certifications, technical skillset, contract requirements, and overall qualifications. At AGE Solutions, we reward performance, invest in growth, and share success. Our benefits support the whole person, professionally, financially, and personally. 26 Days Paid Leave: Includes vacation, sick, personal time, and holidays. You choose how to use it. Performance Bonuses: Performance bonuses are awarded based on individual contributions and company-wide results, aligning recognition with impact. 401(k) with Match: We match 3% of your contributions with immediate vesting. Financial Protection: Company-paid life insurance up to $300K and options for additional coverage for you and your dependents. Health Benefits: Multiple medical plans, dental, vision, FSA and HSA options to fit your needs. Parental Leave: 15 days of fully paid leave for new parents, because family matters. Military Differential Pay: We bridge the gap for employees on active duty, so they don't take a financial hit while serving. Professional Growth: Paid training and certifications, tuition reimbursement, and the tools and tech to get the job done right. Shared Success: In the event of a company sale, our CEO has committed to returning 80% of net proceeds to employees. This ensures our team shares in the long term value they help create. At AGE, you'll do work that matters, supported by a company that delivers for its people.

Job Description Job Description About Us AGE Solutions is a premier technology and professional services company, providing in-depth consulting, advanced technology solutions, and essential services throughout the U.S. government, defense, and intelligence sectors. Prioritizing innovation and client-focused solutions, we assist major agencies in addressing intricate issues and ensuring a more secure future. The Security Control Assessor Representative (SCA-R) provides cybersecurity assessment, Risk Management Framework (RMF), and Assessment and Authorization (A&A) support for Department of Defense (DoD) information systems. The SCA-R works with Information System Security Managers (ISSMs), Program Management Offices (PMOs), system owners, technical teams, and Government cybersecurity stakeholders to assess security controls, identify cybersecurity risks, validate system compliance, and support authorization decisions throughout the system lifecycle. The SCA-R performs independent technical and risk-based assessments using Government-approved processes, databases, and cybersecurity tools and develops complete, accurate, and defensible authorization documentation for Government and Authorizing Official (AO) review. Responsibilities Include: Use Government-assigned tools and databases to perform weekly updates, maintain system records, track assigned actions, and complete cybersecurity assessment and authorization activities. Coordinate with ISSMs, PMOs, system owners, and technical stakeholders to understand system architectures, security requirements, authorization boundaries, configurations, and system changes. Conduct risk analysis, security control assessment, and authorization activities across applicable RMF steps using approved RE5 tools and processes. Verify system authorization boundaries and validate system security categorizations in accordance with FIPS 199 and applicable DoD requirements. Identify applicable data classifications and conduct system-level cybersecurity risk assessments. Assess threats, vulnerabilities, control deficiencies, and residual risks and compile findings into complete and accurate authorization packages. Evaluate proposed and implemented system changes, determine their potential security and authorization impacts, and provide appropriate status and risk information to the Authorizing Official (AO). Evaluate authorization and change requests, including web-filtering requests, firewall exceptions, ports and protocols, cybersecurity risks, STIG/SRG compliance, and on-site security requirements. Review and validate compliance with applicable Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), security controls, and cybersecurity requirements. Review, validate, and track Plans of Action and Milestones (POA&Ms) and associated cybersecurity deficiencies through resolution. Lead and support on-site assessment visits, including planning, technical assessments, stakeholder coordination, entrance/exit briefings, documentation, findings development, and reporting. Maintain access to and proficiency with required Government cybersecurity databases, vulnerability assessment platforms, endpoint security solutions, scanning tools, and RMF management systems. Attend required Government meetings, technical exchanges, and training to remain current with policies, procedures, tools, and RMF process changes. Complete required assessor, vulnerability scanning, endpoint security, and RMF process training. Support assigned systems throughout their lifecycle in accordance with FISMA, DoD RMF, and applicable cybersecurity requirements. Prepare and submit weekly activity reports documenting completed and ongoing activities, tracking identifiers, assessment status, significant findings, risks, issues, and key updates. Independently assess security control deficiencies and residual risks, evaluate alternative corrective actions, and recommend risk-based remediation priorities. Advise the Authorizing Official and Government cybersecurity stakeholders on the security risks and operational implications of system changes, exception requests, and authorization decisions. Required Skills, Qualifications and Experience: Education: Bachelor's degree required. A bachelor's in information technology, Cybersecurity, Computer Science, Information Systems, or related technical field is preferred. Overall Experience: Minimum of eight (8) years of experience in a cybersecurity or network security position. A&A Experience: Minimum of five (5) years of experience performing Certification and Accreditation (C&A) and/or Assessment and Authorization (A&A) activities. Security Clearance: Active DoD Top Secret clearance with Sensitive Compartmented Information (SCI) eligibility. Certification: Current DoD 8570 IAM Level III certification. Skills: Demonstrated experience serving as a Security Control Assessor Representative (SCA-R) and performing cybersecurity risk analysis and security control validation. Advanced understanding and practical application of the Risk Management Framework (RMF), including NIST SP 800-37, NIST SP 800-53, and CNSSI 1253. Demonstrated experience applying and evaluating Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), Plans of Action and Milestones (POA&Ms), cybersecurity security controls, and industry/DoD cybersecurity best practices. Demonstrated hands-on experience with relevant cybersecurity and RMF tools, including one or more of the following: eMASS, STIG Viewer, Nessus, ACAS, SCAP, and HBSS/Endpoint Security Solutions (ESS). Advanced understanding of multiple cybersecurity technology areas and domains, including network technologies and security, mobility, Windows, UNIX/Linux, cloud environments, cloud-native tools and services, HBSS/Endpoint Security Solutions (ESS), databases, and applications. Strong customer service and stakeholder engagement skills, with the ability to effectively coordinate with Government customers, ISSMs, PMOs, technical teams, system owners, and cybersecurity leadership. Ability to analyze complex technical and cybersecurity information and clearly communicate security risks, vulnerabilities, assessment findings, residual risk, and recommended corrective actions through written documentation and technical briefings. Location and Schedule: This role may be based at one of the following customer locations, with onsite requirements varying by location: Chambersburg, PA: Fully onsite, 5 days per week. Arlington, VA or Fort Meade, MD: Hybrid schedule, 4 days onsite per week with 1 telework day. Travel Requirements: Must be willing and able to support occasional domestic (CONUS) and international (OCONUS) travel, approximately 10% of the time. Work Environment and Physical Demand: Must be able to sit at a desk throughout the day and be able to visit customers within their office on a daily basis. The projected salary range for this position is $100,000+ annually. Final compensation will be determined based on factors including years of relevant experience, active security clearance level, certifications, technical skillset, contract requirements, and overall qualifications. At AGE Solutions, we reward performance, invest in growth, and share success. Our benefits support the whole person, professionally, financially, and personally. 26 Days Paid Leave: Includes vacation, sick, personal time, and holidays. You choose how to use it. Performance Bonuses: Performance bonuses are awarded based on individual contributions and company-wide results, aligning recognition with impact. 401(k) with Match: We match 3% of your contributions with immediate vesting. Financial Protection: Company-paid life insurance up to $300K and options for additional coverage for you and your dependents. Health Benefits: Multiple medical plans, dental, vision, FSA and HSA options to fit your needs. Parental Leave: 15 days of fully paid leave for new parents, because family matters. Military Differential Pay: We bridge the gap for employees on active duty, so they don't take a financial hit while serving. Professional Growth: Paid training and certifications, tuition reimbursement, and the tools and tech to get the job done right. Shared Success: In the event of a company sale, our CEO has committed to returning 80% of net proceeds to employees. This ensures our team shares in the long term value they help create. At AGE, you'll do work that matters, supported by a company that delivers for its people.

Job Description Job Description Overview Security Control Assessor (SCA) Arlington, VA Are you ready to enhance your skills and build your career in a rapidly evolving business climate? Are you looking for a career where professional development is embedded in your employer's core culture? If so, Chenega Military, Intelligence & Operations Support (MIOS) could be the place for you! Join our team of professionals who support large-scale government operations by leveraging cutting-edge technology and take your career to the next level! SecuriGence delivers essential technology services to our customers in support of their missions to sustain the national security and economic interests of our nation. SecuriGence is seeking a talented Security Control Assessor to help contribute to our success. Come help us solve problems with Innovation Through Intelligence. Responsibilities Advise the A&A Manager concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Conduct a Security Assessment Plan (SAP) for each package assessment. Ensure security assessments are completed for each IS and package is submitted before or on target date. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the A&A Manager, CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the A&A Manager under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop a continuous monitoring plan specific to the information system. Other duties as assigned. Qualifications Bachelor's degree required OR Associate's degree with 2+ years of relevant experience OR High school diploma or GED equivalent with 4+ years relevant experience 5+ years relevant experience DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) required Top Secret clearance with SCI eligibility is required Knowledge, Skills and Abilities: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience in assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Strong knowledge of CSAM Expert with documenting and or reviewing security materials such as; system security plans (SSP), Security Assessment Report (SAR), Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings. How you'll grow At Chenega MIOS, our professional development plan focuses on helping our team members at every level of their careers to identify and use their strengths to do their best work every day. From entry-level employees to senior leaders, we believe there's always room to learn. We offer opportunities to help sharpen skills in addition to hands-on experience in the global, fast-changing business world. From on-the-job learning experiences to formal development programs, our professionals have a variety of opportunities to continue to grow throughout their careers. Benefits At Chenega MIOS, we know that great people make a great organization. We value our team members and offer them a broad range of benefits. Learn more about what working at Chenega MIOS can mean for you. Chenega MIOS's culture Our positive and supportive culture encourages our team members to do their best work every day. We celebrate individuals by recognizing their uniqueness and offering them the flexibility to make daily choices that can help them be healthy, centered, confident, and aware. We offer well-being programs and continuously look for new ways to maintain a culture where we excel and lead healthy, happy lives. Corporate citizenship Chenega MIOS is led by a purpose to make an impact that matters. This purpose defines who we are and extends to relationships with our clients, our team members, and our communities. We believe that business has the power to inspire and transform. We focus on education, giving, skill-based volunteerism, and leadership to help drive positive social impact in our communities. Learn more about Chenega's impact on the world. Chenega MIOS News- Tips from your Talent Acquisition Team We want job seekers exploring opportunities at Chenega MIOS to feel prepared and confident. To help you with your research, we suggest you review the following links: Chenega MIOS web site - Glassdoor at-Chenega-MIOS- EI_IE369514.11,23.htm LinkedIn - Facebook -

Job Description Job Description Experienced assessor sought to lead rigorous, evidence-based security assessments of cloud and hybrid systems supporting federal missions. Who we are looking for: Spry Methods is seeking an experienced Senior Cloud Security Assessor to join our team in the Washington, DC area. The successful candidate will bring extensive hands-on experience conducting independent security control assessments of cloud and hybrid systems, with particular depth in federal cloud environments. This role requires sound professional judgment, strong analytical skills, and a practical, common-sense approach to applying security requirements to system data, technical evidence, mission context, and actual risk. Key Responsibilities: • Lead full-cycle Security Assessment and Authorization (SA&A) activities for cloud, hybrid, and enterprise systems as an independent assessor. • Assess Microsoft Azure and Amazon Web Services (AWS) environments, including the implementation and operating effectiveness of administrative, operational, and technical security controls. • Retrieve and review FedRAMP authorization packages and supporting documentation, then analyze the package for applicability, control inheritance, residual risk, gaps, and customer responsibilities. • Conduct detailed analysis of assessment artifacts, including system security plans, policies, procedures, architecture and data-flow diagrams, inventories, configurations, logs, scan results, test outputs, and other supporting evidence. • Develop Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Risk Assessment Reports (RARs), Required Evidence Lists, and Plans of Action and Milestones (POA&Ms). • Perform network, system, application, and NIST security control testing from administrative, operational, and technical perspectives. • Analyze vulnerability scan results, interpret risk, and use manual validation and corroborating evidence to distinguish actionable findings from false positives or unsupported conclusions. • Apply security requirements using practical judgment and data context rather than relying solely on checklist compliance. Evaluate whether evidence is relevant, reliable, sufficient, and representative of the assessed environment. • Clearly communicate findings, risk, root cause, and feasible mitigation options to technical teams, system owners, executives, and other assessment stakeholders. • Coordinate evidence requests, interviews, test activities, and assessment schedules with customer personnel and Information Systems Security Analysts. • Support security assessment program operations and contribute to consistent assessment methods, quality reviews, and defensible reporting. Minimum Qualifications • Active Certified Information Systems Security Professional (CISSP) certification is required. • At least eight years of demonstrated, hands-on experience conducting security control assessments, including substantial experience serving as an independent assessor for cloud and hybrid systems. • Extensive experience conducting independent security assessments of federal systems hosted in Microsoft Azure and AWS environments, including evaluation of security controls, architecture, inherited controls, customer-configured controls, and cloud-specific risks. • Demonstrated experience retrieving, navigating, and analyzing FedRAMP authorization packages and associated security artifacts. • Strong knowledge of federal Risk Management Framework (RMF) processes and NIST security control assessment practices. • Ability to analyze large volumes of technical and governance evidence, connect information across artifacts, identify inconsistencies, and reach clear, supportable conclusions. • Strong understanding of IT security requirements, technical countermeasures, vulnerability management, risk management, contingency planning, secure data communications, and system security architecture. • Excellent technical writing and stakeholder communication skills, with the ability to explain risk and recommended mitigation in clear, decision-oriented language. • Bachelor's degree in cybersecurity, information technology, computer science, or a related field, or eight additional years of relevant specialized experience. • Experience using CSAM or a comparable governance, risk, and compliance platform. Preferred Qualifications • Certificate of Cloud Security Knowledge (CCSK), Certified Cloud Security Professional (CCSP), Certified Governance, Risk and Compliance (CGRC), or comparable cloud or assessment certification. • Experience supporting federal cybersecurity programs and conducting assessments, audits, or control implementation reviews in accordance with NIST Special Publications. • Experience assessing cloud service offerings that rely on FedRAMP-authorized services and documenting control inheritance and customer responsibility requirements. • DoD 8570/8140 IAM Level II eligibility or an equivalent qualification, when required by the customer environment. • Experience evaluating privacy and data protection considerations as part of security assessments. Success in this role: The successful assessor is technically credible, independent, and evidence-driven. They know when the data supports a finding, when additional validation is needed, and when a requirement must be interpreted in light of architecture, mission use, and actual exposure. They produce assessment results that are clear, consistent, defensible, and actionable. We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.

Job Description Job Description Description: Job Title: Security Control Assessor Location: On Site in Arlington, VA Department: Cyber Security Services Reports To: Management FLSA Status: Full Time/Non-exempt Job Purpose: The security control assessor (SCAs) supports a critical, objective role to evaluate the effectiveness of implemented controls in mitigating security risks. The SCA will support a critical mission within the intelligence community. In the role as a SCA, you are expected to use automated scanning tools, manual techniques, and specialized testing methodologies to identify weaknesses and vulnerabilities. The SCA is expected to be a collaborative member of the RMF program of the organization, to provide intelligent input to system security architectures in order to align with RMF principles and guidelines. This includes ensuring to guide the RMF process so that security controls are integrated seamlessly into system designs to provide comprehensive protection against threats and vulnerabilities. Duties & Responsibilities: The SCA's specific duties include: Advise the Information System Owner (ISO) concerning the impact levels for Confidentiality, Integrity, and Availability for the information on systems. Ensure security assessments are completed for each IS. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the CISO and AO under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop the continuous monitoring plan specific to the information system. The SCA is responsible for the RMF deliverables associated with Step 4 of DOD and IC RMF Policies for assigned systems. This includes, but is not limited to: Security Assessment Plans tailored to specific systems control requirements Security control assessment input, which includes narratives for the review of controls and artifacts Security Assessment Reports ATO recommendations or ATO with Condition Memorandums Conduct initial remediation actions once a security assessment has been completed to ensure proper hand off to the ISSM and ISSOs. Assessment of selected controls IAW continuous monitoring strategy The SCA is expected to have additional duties as assigned in support of corporate cyber security services. Additional details are reviewed in accordance with company policies. Requirements: Required Skills & Experience: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings Qualifications: Bachelor's Degree in Computer Science or a related technical discipline Master's Degree preferred. Minimum 6-10 years of experience. Must currently possess an active TS/SCI with the ability to obtain and maintain a CI polygraph. DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) is required Systems Security Engineering background preferred. Effective communication skills to collaborate with cross-functional teams and stakeholders on implementing security measures organization-wide. Strong analytical skills for identifying system vulnerabilities and documenting control remediation recommendations through collaboration on System Impact Analysis and Documented Risk Acceptance. Detail-oriented with the ability to manage multiple tasks and prioritize effectively. Comprehensive knowledge of RMF activities at a senior level (ability to articulate to Executive audiences preferred). Familiarity with federal regulatory requirements, contractual obligations, and industry standards related to information security. Evaluate adherence to standards such as Privacy, GDPR, and HIPAA Other: This is typical office or administrative work, and there is no exposure to adverse environmental conditions. This position requires sedentary work. Sedentary work is defined as: Exerting up to 10 pounds of force occasionally and/or a negligible amount of force frequently or constantly to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time. Jobs are sedentary if walking and standing are required only occasionally, and all other sedentary criteria are met.

Job Description Job Description About Us AGE Solutions is a premier technology and professional services company, providing in-depth consulting, advanced technology solutions, and essential services throughout the U.S. government, defense, and intelligence sectors. Prioritizing innovation and client-focused solutions, we assist major agencies in addressing intricate issues and ensuring a more secure future. AGE Solutions is looking for Senior Security Control Assessors to join our team in support of a cybersecurity risk management and assessment program with our DoD customer. Responsibilities: Conduct cybersecurity assessments, audits, and inspections for DoD organizations and partners handling DoD information or connecting to the DoDIN. Evaluate systems and Defensive Cyberspace Operations using cyber threat emulation and performance-based testing. Adhere to policies and processes for each assessment type. Support assessment development and execution to ensure security expertise is properly applied. Coordinate logistics, test plans, and scope with the SCA Team Lead. Perform vulnerability assessments, capture results using STIG Viewer or designated tools, and document findings in eMASS. Analyze security gaps and provide mitigation recommendations. Validate cybersecurity controls, TTPs, STIGs, RMF controls, and compliance with DoD policies and guidelines. Provide risk analysis and assessment results for authorization recommendations. Participate in daily assessment reviews, in-briefs, and out-briefs, sharing findings with the SCA-R. Mentor and guide personnel by providing technical expertise, best practices, and professional development support to enhance team capabilities and knowledge. Requirements: Bachelor's degree (IT-related field preferred) Eight (8) years of overall experience in cybersecurity or network security position Five (5) years of experience in a Certification and Accreditation/A&A role Must have and maintain an active DoD Top Secret clearance with SCI eligibility Must be able and willing to travel up to approximately 85% of the time, inside and outside the continental United States and internationally (CONUS / OCONUS) DoD 8570 IA Technical (IAT) Level III certification Demonstrated experience with STIGs (Security Technical Implementation Guides), Security Requirement Guides (SRGs), Plan of Action and Milestones (POA&Ms) and cybersecurity best practices Advanced understanding of the RMF process, NIST SP 800- 37, NIST SP 800-53, CNSSI 1253 Demonstrated experience with relevant tools such as eMASS, STIG Viewer, Nessus, ACAS, SCAP, or HBSS Advanced understanding of key technologies areas/domain such as: Network, Mobility, Windows, UNIX, Cloud Environments and Cloud Native Tools/Services, Host Based Security System (HBSS)/Endpoint Security Solutions (ESS), Databases, Applications Strong written and verbal communication skills for reporting assessment findings. Compensation: $95,000 - $105,000 This posting is part of a pipeline for future opportunities supporting the current TASS contract. Employment is contingent upon position availability and government customer approval. AGE Solutions is actively engaging talent and encourages incumbents and new candidates to express interest to be considered if/when opportunities may become available. At AGE Solutions, we reward performance, invest in growth, and share success. Our benefits support the whole person, professionally, financially, and personally. 26 Days Paid Leave: Includes vacation, sick, personal time, and holidays. You choose how to use it. Performance Bonuses: Performance bonuses are awarded based on individual contributions and company-wide results, aligning recognition with impact. 401(k) with Match: We match 3% of your contributions with immediate vesting. Financial Protection: Company-paid life insurance up to $300K and options for additional coverage for you and your dependents. Health Benefits: Multiple medical plans, dental, vision, FSA and HSA options to fit your needs. Parental Leave: 15 days of fully paid leave for new parents, because family matters. Military Differential Pay: We bridge the gap for employees on active duty, so they don't take a financial hit while serving. Professional Growth: Paid training and certifications, tuition reimbursement, and the tools and tech to get the job done right. Shared Success: In the event of a company sale, our CEO has committed to returning 80% of net proceeds to employees. This ensures our team shares in the long term value they help create. At AGE, you'll do work that matters, supported by a company that delivers for its people.

Job Description Job Description Overview Senior Security Control Assessor (SCA) Arlington, VA Are you ready to enhance your skills and build your career in a rapidly evolving business climate? Are you looking for a career where professional development is embedded in your employer's core culture? If so, Chenega Military, Intelligence & Operations Support (MIOS) could be the place for you! Join our team of professionals who support large-scale government operations by leveraging cutting-edge technology and take your career to the next level! SecuriGence delivers essential technology services to our customers in support of their missions to sustain the national security and economic interest of our nation. SecuriGence is seeking a talented Senior Security Control Assessor to help contribute to our success. Come help us solve problems with Innovation Through Intelligence. Responsibilities Advise the A&A Manager concerning the impact levels for Confidentiality, Integrity, and Availability of the information on systems. Conduct a Security Assessment Plan (SAP) for each package assessment. Ensure security assessments are completed for each IS and package is submitted before or on target date. Initiate a POA&M with identified weaknesses and suspense dates for each IS based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the A&A Manager, CISO and AO. Assess proposed changes to Information Systems, their environment of operation, and mission needs that could affect system authorization. Serve as a cybersecurity technical advisor to the A&A Manager under their purview. Be integral to the development of the monitoring strategy. The system-level continuous monitoring strategy must conform to all applicable published DoD enterprise-level or DoD Component-level continuous monitoring strategies. Determine and document in the SAR a risk level for every noncompliant security control in the system baseline for all IS. Determine and document in the SAR an aggregate level of risk to the system and identify the key drivers for the assessment. The SCA's risk assessment considers threats, vulnerabilities, and potential impacts as well as existing and planned risk mitigation. Develop a continuous monitoring plan specific to the information system. Other duties as assigned. Qualifications Bachelor's degree required OR an associate's degree with 2+ years of relevant experience OR High school diploma or GED equivalent with 4+ years of relevant experience 5+ years relevant experience required DOD 8140 IAM Level II (CAP, CASP, CISM, CISSP, GSLC, CCISO) required Top Secret clearance with SCI eligibility is required Knowledge, Skills and Abilities: Strong knowledge of Risk Management Framework (RMF) 800-37 and continuous monitoring 800-137 Expert knowledge and hands-on experience with FISMA Systems, NIST 800-series guidelines, FIPS, Security Assessment & Authorization (SA&A) requirements and processes, Continuous Monitoring Framework experience and its tools, Plan of Action & Milestones (POA&M) policies, and vulnerability/patch management, risk management, project management, proficient with Microsoft products - Word, Excel, PowerPoint. Proficient with vulnerability and scanning tools and well-versed in interpreting risk posture resulting from assessment reports. Experience in project management and tracking, and the Microsoft suite of office products Experience of assessing cloud-based security authorizations (FedRamp, AWS & Azure) as well as the NIST control responsibilities Experience with SAP/JSIG Expert with documenting and or reviewing of security materials such as; system security plans (SSP), Security Assessment Report (SAR), and Security Assessment Plan (SAP), and other documents per NIST 800 guidelines. Experience supporting cloud-based security authorizations (FedRamp, AWS, & Azure) Experience creating Security Assessment Plans, Security Assessment Reports, and Executive-level briefings How you'll grow At Chenega MIOS, our professional development plan focuses on helping our team members at every level of their careers to identify and use their strengths to do their best work every day. From entry-level employees to senior leaders, we believe there's always room to learn. We offer opportunities to help sharpen skills in addition to hands-on experience in the global, fast-changing business world. From on-the-job learning experiences to formal development programs, our professionals have a variety of opportunities to continue to grow throughout their careers. Benefits At Chenega MIOS, we know that great people make a great organization. We value our team members and offer them a broad range of benefits. Learn more about what working at Chenega MIOS can mean for you. Chenega MIOS's culture Our positive and supportive culture encourages our team members to do their best work every day. We celebrate individuals by recognizing their uniqueness and offering them the flexibility to make daily choices that can help them be healthy, centered, confident, and aware. We offer well-being programs and continuously look for new ways to maintain a culture where we excel and lead healthy, happy lives. Corporate citizenship Chenega MIOS is led by a purpose to make an impact that matters. This purpose defines who we are and extends to relationships with our clients, our team members, and our communities. We believe that business has the power to inspire and transform. We focus on education, giving, skill-based volunteerism, and leadership to help drive positive social impact in our communities. Learn more about Chenega's impact on the world. Chenega MIOS News- Tips from your Talent Acquisition Team We want job seekers exploring opportunities at Chenega MIOS to feel prepared and confident. To help you with your research, we suggest you review the following links: Chenega MIOS web site - Glassdoor at-Chenega-MIOS- EI_IE369514.11,23.htm LinkedIn - Facebook -

Job Description Job Description Dark Wolf Solutions is seeking Security Control Assessor/Representatives (SCA/Rs) to lead security control assessments across high-priority projects. Working at the intersection of cybersecurity engineering, cloud architecture, and DevSecOps prototyping, you will evaluate security controls for cutting-edge AI/LLM technologies across multiple classification levels. This position is ideal for a pragmatic cloud assessor or SCAR who excels in fast-paced DevSecOps environments, understands AWS cloud security, and is eager to shape the cybersecurity posture of next-generation DoD AI capabilities.This position will be based out of Arlington, VA. Additional responsibilities include: Key Responsibilities Execute formal SCA/R duties. Lead security assessment efforts, establishing reusable security playbooks and assessment frameworks for rapid AI deployment into enterprise workflows. Evaluate technical control effectiveness across AWS cloud infrastructure, DevSecOps pipelines, microservices, containerized workloads, and GenAI/LLM application stacks. Partner directly with cybersecurity engineering and DevSecOps prototyping teams to integrate security controls early in the development lifecycle. Review, author, and maintain assessment packages-including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and POA&Ms-tailored to rapid prototyping and AI systems. Assess technical security risks specific to AI/LLM implementations, such as API exposure, vector database access controls, model integration surface area, and software supply chain dependencies. Support continuous monitoring (ConMon), technical risk evaluations, and cloud architecture reviews across multi-tenant, multi-classification environments. Coordinate with Authorizing Officials (AOs), program managers, and engineering leads to deliver decision-ready risk briefings and ATO recommendations. Provide technical input and oversight for cybersecurity engineering and penetration testing activities across prototype projects. Required Qualifications Active Top Secret security clearance Current DoD 8570/8140 IAM Level II or Level III certification (e.g., Security+, CySA+, CISM, CISSP, CCISO, CAP/CISC) 3-5+ years of experience conducting security control assessments, compliance testing, or A&A/RMF activities for DoD or federal information systems Solid operational understanding of core AWS cloud services (EC2, S3, IAM, VPCs, Security Groups, Security Hub) and how security controls function within cloud-native and CI/CD pipeline environments. Strong working knowledge of NIST SP 800-53 (Rev. 4/5), NIST SP 800-37 (RMF), DoD Cloud Computing SRG, and FedRAMP baselines. Demonstrated experience writing and evaluating core RMF artifacts (SSPs, SAPs, SARs, POA&Ms) Exceptional written and verbal communication skills, with the ability to articulate technical risk clearly to executive stakeholders, Authorizing Officials, and engineering teams. Hands-on experience navigating government GRC repositories, such as eMASS or XACTA. Desired Qualifications Hands-on experience mapping security controls to the NIST AI Risk Management Framework (AI RMF), the OWASP Top 10 for LLM Applications, or the DoD Responsible AI (RAI) Guidelines. Familiarity evaluating secure design patterns for autonomous AI Agents (e.g., tool-calling permissions, sandboxing agent execution environments, prompt boundaries, and ReAct/LangGraph architectures). Experience assessing cloud-managed AI ecosystems and foundation model platforms (e.g., AWS Bedrock, AWS SageMaker, Hugging Face Enterprise, or self-hosted open-source models). Understanding of data protection, access controls, and boundary security for RAG pipelines and vector databases (e.g., OpenSearch Vector Engine, Pinecone, Milvus, or PostgreSQL pgvector). Familiarity evaluating risks unique to LLMs-including prompt injection, data poisoning, model inversion, insecure output handling, and open-source supply chain vulnerabilities in AI libraries (PyTorch, LangChain, LlamaIndex). Exposure to LLM guardrail platforms, evaluation frameworks, or AI security tools (e.g., Promptfoo, Garak, Giskard, NeMo Guardrails) used to test model robustness and output safety. Experience with cATO methodologies, Infrastructure as Code (IaC) templates (Terraform, CloudFormation), and container security (AWS EKS/ECS, Docker). Active AWS Certifications (e.g., AWS Certified Security - Specialty or AWS Certified Solutions Architect). Background or familiarity with offensive security, penetration testing The salary range for this position is estimated to be between $135,000.00 - $150,000.00, commensurate on experience and technical skillset. We are proud to be an EEO/AA employer Minorities/Women/Veterans/Disabled and other protected categories. In compliance with federal law, all persons hired will be required to verify identity, confirm US Citizenship, and complete the required employment eligibility verification upon hire. We are strictly looking for direct, full-time W2 employees. We do not engage with third-party staffing agencies, C2C, or 1099 independent contractors for this role.

Job Description Job Description About Us AGE Solutions is a premier technology and professional services company, providing in-depth consulting, advanced technology solutions, and essential services throughout the U.S. government, defense, and intelligence sectors. Prioritizing innovation and client-focused solutions, we assist major agencies in addressing intricate issues and ensuring a more secure future. AGE Solutions is looking for a Cloud SCA-R, Senior to join our team in support of an upcoming cybersecurity risk management and assessment program with our DoD customer. As a Team Lead, you will be responsible for performing analysis, conducting independent validations of assessments, and Continuous Monitoring (ConMon) for authorized CSPs and CSOs. Individuals in this role must be available to work full-time on-site at Ft. Meade, MD. Duties and Responsibilities Include: Conduct cybersecurity assessments and validations of Cloud Service Offerings (CSOs) in support of the Department of Defense (DoD) Provisional Authorization (PA) process. Evaluate Cloud Service Provider (CSP) documentation packages following government guidance and procedures, including key artifacts such as the Cloud Architecture Diagram, System Security Plan (SSP), SSP Addendum, Readiness Assessment Report (RAR), System Architecture, Security Assessment Plan (SAP), Security Assessment Report (SAR), and associated Plans of Action & Milestones (POA&Ms). Review, analyze, and process additional documents including Change Requests, Extension Requests, Deviation Requests, Whitelist Requests, Corrective Action Plans, templates, process guide approvals, and continuous monitoring (ConMon) artifacts for existing Provisional Authorizations. Prepare and deliver up to 30 Cloud Security Assessment Packages annually, each including validated cybersecurity controls, certifier recommendations, and a statement of residual risk. Participate in technical kickoff meetings and review preliminary documentation to assess a CSP's readiness posture. Analyze and provide detailed feedback on CSP submissions such as the RAR, SAP, SSP, and architectural diagrams. Assess and document the operational impact of authorizations, changes, and vulnerabilities on the CSP environment. Develop Cloud Security Assessment Packages in accordance with established guidelines, including the SAR, POA&M, and any Deviation Requests. Draft Authorization Recommendation Memoranda outlining CSO compliance with DoD cybersecurity controls, residual risks, and technical findings. Prepare formal DoD Provisional Authorization memoranda, detailing authorization length, CSO boundary, services provided, operating conditions, DoD usage considerations, and follow-on activities. Validate CSO controls within eMASS or other government-provided Governance, Risk, and Compliance (GRC) tools; ensure accurate tracking in the Mission Status Report (MSR). Review and verify the Customer Responsibility Matrix (CRM), ensuring proper control inheritance is reflected in eMASS/GRC systems. Upload authorization conditions as system-level POA&Ms in eMASS and monitor their resolution. Organize and associate all received documentation with applicable security controls within eMASS. Maintain and update the DoD Cloud Process Guide, including all checklists, templates, forms, and guidance documents. Assist in developing internal requirements and how-to guides for assessors conducting CSP validations. Document and refine assessment procedures and validation best practices to align with DoDI 8510.01 and the DoD Cloud Computing Security Requirements Guide (SRG). Contribute to the ongoing development and annual updates of the DoD Cloud Assessment Process Guides as requested by the Government. Requirements: Bachelor's degree (IT-related field preferred) Eight (8) years of overall experience in cybersecurity or network security position Have an active DoD Top Secret clearance with SCI eligibility DoD 8570 IAM/IA Technical (IAT) Level III certification Familiarity with security controls for Azure, AWS, and assorted cloud platforms Solid understanding of DoD Risk Management Framework (RMF), DoDI 8510.01, and DoD Cloud Computing Security Requirements Guide (SRG) Familiarity with security controls for Azure, AWS, and assorted cloud platforms Hands-on experience with eMASS or other government-provided GRC tools Familiarity with cloud security documentation, including SSPs, SARs, RARs, and POA&Ms Ability to analyze complex cloud architectures and provide accurate risk assessments Strong technical writing and communication skills to produce security assessment reports and formal recommendations Applicants must reside within a commutable distance of Ft. Meade, MD in order to work onsite full time. The projected salary range for this position is $115,000+ annually. Final compensation will be determined based on factors including years of relevant experience, active security clearance level, certifications, technical skillset, contract requirements, and overall qualifications. At AGE Solutions, we reward performance, invest in growth, and share success. Our benefits support the whole person, professionally, financially, and personally. 26 Days Paid Leave: Includes vacation, sick, personal time, and holidays. You choose how to use it. Performance Bonuses: Performance bonuses are awarded based on individual contributions and company-wide results, aligning recognition with impact. 401(k) with Match: We match 3% of your contributions with immediate vesting. Financial Protection: Company-paid life insurance up to $300K and options for additional coverage for you and your dependents. Health Benefits: Multiple medical plans, dental, vision, FSA and HSA options to fit your needs. Parental Leave: 15 days of fully paid leave for new parents, because family matters. Military Differential Pay: We bridge the gap for employees on active duty, so they don't take a financial hit while serving. Professional Growth: Paid training and certifications, tuition reimbursement, and the tools and tech to get the job done right. Shared Success: In the event of a company sale, our CEO has committed to returning 80% of net proceeds to employees. This ensures our team shares in the long term value they help create. At AGE, you'll do work that matters, supported by a company that delivers for its people.

Job Description Job Description Dark Wolf Solutions is seeking Security Control Assessor/Representatives (SCA/Rs) to lead security control assessments across high-priority projects. Working at the intersection of cybersecurity engineering, cloud architecture, and DevSecOps prototyping, you will evaluate security controls for cutting-edge AI/LLM technologies across multiple classification levels. This position is ideal for a pragmatic cloud assessor or SCAR who excels in fast-paced DevSecOps environments, understands AWS cloud security, and is eager to shape the cybersecurity posture of next-generation DoD AI capabilities.This position will be based out of Arlington, VA with hybrid/remote opportunities. Additional responsibilities include: Key Responsibilities Execute formal SCA/R duties. Lead security assessment efforts, establishing reusable security playbooks and assessment frameworks for rapid AI deployment into enterprise workflows. Evaluate technical control effectiveness across AWS cloud infrastructure, DevSecOps pipelines, microservices, containerized workloads, and GenAI/LLM application stacks. Bridge the gap between OffSec and development by applying software design best practices. Lead technical exchange meetings (TEMs), participate in Discovery & Framing workshops, and maintain effective communication with cross-functional teams and stakeholders. Act as the primary subject matter expert and lead developer for custom offensive tooling, integrating disparate capabilities into a cohesive, mission-ready platform. Review, author, and maintain assessment packages-including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and POA&Ms-tailored to rapid prototyping and AI systems. Assess technical security risks specific to AI/LLM implementations, such as API exposure, vector database access controls, model integration surface area, and software supply chain dependencies. Support continuous monitoring (ConMon), technical risk evaluations, and cloud architecture reviews across multi-tenant, multi-classification environments. Coordinate with Authorizing Officials (AOs), program managers, and engineering leads to deliver decision-ready risk briefings and ATO recommendations. Provide technical input and oversight for cybersecurity engineering and penetration testing activities across prototype projects. Required Qualifications Active Top Secret security clearance Current DoD 8570/8140 IAM Level II or Level III certification (e.g., Security+, CySA+, CISM, CISSP, CCISO, CAP/CISC) 5-7+ years of experience conducting security control assessments, compliance testing, or A&A/RMF activities for DoD or federal information systems Solid operational understanding of core AWS cloud services (EC2, S3, IAM, VPCs, Security Groups, Security Hub) and how security controls function within cloud-native and CI/CD pipeline environments. Experience with GitLab CI/CD (pipeline design, runners, artifact management) and AWS Cloud services (EC2, VPC, IAM, S3). Strong working knowledge of NIST SP 800-53 (Rev. 4/5), NIST SP 800-37 (RMF), DoD Cloud Computing SRG, and FedRAMP baselines. Demonstrated experience writing and evaluating core RMF artifacts (SSPs, SAPs, SARs, POA&Ms) Exceptional written and verbal communication skills, with the ability to articulate technical risk clearly to executive stakeholders, Authorizing Officials, and engineering teams. Hands-on experience navigating government GRC repositories, such as eMASS or XACTA. Desired Qualifications Hands-on experience mapping security controls to the NIST AI Risk Management Framework (AI RMF), the OWASP Top 10 for LLM Applications, or the DoD Responsible AI (RAI) Guidelines. Familiarity evaluating secure design patterns for autonomous AI Agents (e.g., tool-calling permissions, sandboxing agent execution environments, prompt boundaries, and ReAct/LangGraph architectures). Experience assessing cloud-managed AI ecosystems and foundation model platforms (e.g., AWS Bedrock, AWS SageMaker, Hugging Face Enterprise, or self-hosted open-source models). Understanding of data protection, access controls, and boundary security for RAG pipelines and vector databases (e.g., OpenSearch Vector Engine, Pinecone, Milvus, or PostgreSQL pgvector). Familiarity evaluating risks unique to LLMs-including prompt injection, data poisoning, model inversion, insecure output handling, and open-source supply chain vulnerabilities in AI libraries (PyTorch, LangChain, LlamaIndex). Exposure to LLM guardrail platforms, evaluation frameworks, or AI security tools (e.g., Promptfoo, Garak, Giskard, NeMo Guardrails) used to test model robustness and output safety. Experience with cATO methodologies, Infrastructure as Code (IaC) templates (Terraform, CloudFormation), and container security (AWS EKS/ECS, Docker). Active AWS Certifications (e.g., AWS Certified Security - Specialty or AWS Certified Solutions Architect). Background or familiarity with offensive security, penetration testing The salary range for this position is estimated to be between $135,000.00 - $160,000.00, commensurate on experience and technical skillset. We are proud to be an EEO/AA employer Minorities/Women/Veterans/Disabled and other protected categories. In compliance with federal law, all persons hired will be required to verify identity, confirm US Citizenship, and complete the required employment eligibility verification upon hire. We are strictly looking for direct, full-time W2 employees. We do not engage with third-party staffing agencies, C2C, or 1099 independent contractors for this role.

Job Description Job Description Oneida Technical Solutions, LLC (OTS), was founded in 2014 and quickly established itself as a reliable partner capable of providing a variety of information technology and cyber solutions across highly complex, highly regulated and highly secure environments, including the U.S. Department of Defense (DoD), healthcare, higher education, law enforcement, retail, casino gaming and more. Our innovative cyber capabilities and programs have made us trusted partners for IT modernization projects, implementing upgrades and accelerating the delivery of new solutions for the DoD and commercial industries with consumer-driven technology. OTS is seeking a Security Controls Assessor in providing cybersecurity support to AFCENT - this role is onsite at Shaw AFB in Sumter, SC. In this role you will perform comprehensive IT security control assessments on AFCENT systems and software applications. Assessments shall require physical travel to various contractor and Government sites inside and outside the continental United States (CONUS and OCONUS). Assessments shall determine the condition of the management, operational, and technical security controls employed within or inherited by an information system or software to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). Duties for this role include, but are not limited to: Perform initial and continual security control assessment and validation for AFCENT networks, systems, and software applications. Utilize DOD approved tools such as, but not limited to - Assured Compliance Assessment Solution (ACAS), Nessus, Host Based Security Systems (HBSS), Continuous Monitoring Risk Scoring (CMRS), Online Compliance Reporting System (OCRS), and SolarWinds - to generate initial and continuous monitoring reports. Complete reports to support risk decisions from the AO, both as required and as requested. Provide an assessment on the severity of weaknesses or deficiencies discovered in the information system or software application and its environment of operation and recommend corrective actions to address identified vulnerabilities. Review the System Security Plan (SSP), prior to initiating the security control assessment and ensure the plan provides a set of security controls for the information system or software application that meet the stated security requirements. Advise the Information System Owner (ISO) concerning the impact values for confidentiality, integrity, and availability for the information on a system or software application. Evaluate threats and vulnerabilities to information systems or software application to ascertain the need for additional safeguards. Assist in creating, reviewing, and approving the information system or software application security assessment plan, which is comprised of the SSP, the Security Controls Traceability Matrix (SCTM), and the Security Control Assessment Procedure. Ensure security control assessments are completed for each information system or software application and ensure controls are working as intended and these controls protect the confidentiality, integrity and availability of IT resources at the appropriate levels. Assist with preparing the final Security Assessment Report (SAR) containing the results and findings from the assessment at the conclusion of each security control assessment activity. Ensure a Plan of Action and Milestones (POA&M) is initiated by the Information System Security Officer (ISSO) for the information system based on findings and recommendations from the SAR. Evaluate security control assessment documentation and provide written recommendations for security authorization to the AO. Provide expertise to execute vulnerability assessments on Platform IT systems. Assist with assembling and submitting the security authorization artifacts to the AO (consisting of, at a minimum, the SSP, the SAR, the POA&M, and a Risk Assessment Report (RAR). Assess the proposed changes to information systems or software application, their environment of operation, and mission needs to determine if they are security-relevant and could therefore affect system authorization. Utilize the RMF methodology to successfully implement an information technology process which shall effectively protect the element's information assets and its ability to perform its mission. Provide guidance to other assessors on the policies and procedures of the job; Provide detailed assessment findings using Government-specified processes and procedure. Provide solutions and recommendations to remedy security vulnerabilities, threats, to ultimately improve the protection of IT resources and to execute the AFCENT mission. Utilize assessment results to identify trends and to improve IA training, policies and processes. Develop reports and trend analysis's to support risk assessment decisions. Qualified candidates must meet the following mandatory requirements: Must possess and maintain a Secret Clearance Proof of IAT-III or IAM-III Certification Senior (III) and higher positions (Preferred): - MA/MS in related field AND 3 or more years' relevant experience; or - BS in related field AND 5 or more years' relevant IT experience; or - 7 or more years' relevant IT experience. Mid-level (II) or lower positions: - BS in related field AND 1 or more years' relevant experience; or - Associates in related field and 3 or more years' relevant IT experience; or - 5 or more years' of relevant IT experience. Oneida Technical Solutions, LLC. is an equal opportunity employer and will consider all qualified applicants for employment without regard to race, color, religion, sex, national origin, age, disability, marital status, veteran status, sexual orientation, gender identity, genetic information or any other protected characteristic under applicable law. Job Posted by ApplicantPro

Job Description Job Description Security Control Accessor II REQ-26-J-1341 The SCA is responsible for conducting a comprehensive assessment of the management, operational, and technical security controls employed within or inherited by an IS to determine the overall effectiveness of the controls (i.e., the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system). SCAs also provide an assessment of the severity of weaknesses or deficiencies discovered in the IS and its environment of operation and recommend corrective actions to address identified vulnerabilities. Responsibilities will cover Collateral, Sensitive Compartmented Information (SCI) and Special Access Program (SAP) activities within the customer's area of responsibility. Performance shall include: Perform oversight of the development, implementation and evaluation of IS security program policy; special emphasis placed upon integration of existing SAP network infrastructure. Perform assessment of ISs, based upon the Risk Management Framework (RMF) methodology in accordance with the Joint Special Access Program (SAP) Implementation Guide (JSIG). Advise the Information System Owner (ISO), Information Data Owner (IDO), Program Security. Officer (PSO), and the Delegated and/or Authorizing Official (DAO/AO) on any assessment and authorization issues. Evaluate Authorization packages and make recommendation to the AO and/or DAO for authorization. Evaluate IS threats and vulnerabilities to determine whether additional safeguards are required. Advise the Government concerning the impact levels for Confidentiality, Integrity, and Availability for the information on a system. Ensure security assessments are completed and results documented and prepare the Security Assessment Report (SAR) for the Authorization boundary. Initiate a Plan of Action and Milestones (POA&M) with identified weaknesses for each Authorization Boundaries assessed, based on findings and recommendations from the SAR. Evaluate security assessment documentation and provide written recommendations for security authorization to the Government. Discuss recommendation for authorization and submit the security authorization package to the AO/DAO Assess proposed changes to Authorization boundaries operating environment and mission needs to determine the continuation to operate. Review and concur with all sanitizations and clearing procedures in accordance with Government guidance and/or policy. Assist the Government compliance inspections. Assist the Government with security incidents that relate to cybersecurity and ensure that the proper and corrective measures have been taken. Ensure organization are addressing and conducting all phases of the system development life cycle (SDLC). Evaluate Hardware and Software to determine security impact that it might have on Authorization boundaries. Evaluate the effectiveness and implementation of Continuous Monitoring Plans. Represent the customer on inspection teams. EDUCATION: Bachelor's degree or equivalent experience (4 years) CLEARANCE: Top-Secret w/SCI Eligibility MANDATORY: 7-9 years related experience; 4+ years' experience in SAP, SCI, or Collateral Information Systems (S) security and implantation of regulations identified in the description of duties; Prior performance in the role of ISSO and ISSM or SCA; TRAINING: IAM Level II (in lieu of IAT Level III) BENEFITS: We offer a competitive compensation package including a generous PTO and Flexible holiday package, tax-free healthcare cost reimbursement, and an immediate vesting 401K with 4% matching.

Job Description Job Description ProSync is seeking passionate Information System Security Specialist III to help provide mid level cybersecurity support for Navy information systems, networks, and mission environments. This role assists in implementing, maintaining, and monitoring security controls in accordance with DoD and federal cybersecurity policies. ProSync Technology Group, LLC (ProSync) is an award-winning, SDVOSB Defense Contracting company with a strong military heritage and a record of excellence in supporting the Department of Defense and the Intelligence Community. If you have prior military service or government contracting experience, are proud to serve and support our nation, and want to help support ProSync's mission to "Define and Redefine the State of Possible," please apply today! RESPONSIBILITIES The Information System Security Specialist is responsible for supporting all aspects of a Program Information Assurance (IA) processes tailored to include minimum qualification standards, fundamental awareness and familiarity to demonstrated competency with specific experience in Cyber Security, Engineering, Test & Evaluation, (T&E) and/or Security Control Assessor (SCA) under a Certification & Accreditation (C&A) and/or Assessment & Authorization (A&A) process. The specialist should demonstrate a working knowledge of the Risk Management Framework (RMF) process and/or include prior experience with the Defense Information Assurance & Certification Accreditation Process (DIACAP). Familiarity with security policies & guidance documents to assist with the preparation and maintenance of process artifacts, traceability documents purposed for compliance with Authority to Operate (ATO) requirements. The specialist is expected to evaluate security solutions to ensure they meet security requirements for processing up to classified information, and supervise and/or maintain the operational security posture for an information system or program. Support the development, documentation, and maintenance of system security plans, procedures, and authorization artifacts. Assist in implementing security controls and ensuring compliance with applicable cybersecurity frameworks (e.g., RMF, NIST, DoD directives). Conduct routine security assessments, vulnerability scans, and configuration checks to identify and report security risks. Support incident response activities, including evidence collection, initial triage, and coordination with senior cybersecurity personnel. Maintain awareness of system configurations, user access requirements, and security posture changes. Assist in preparing documentation for system authorization, continuous monitoring, and audit readiness. Provide user support on security procedures, access requirements, and proper handling of sensitive information. Requirements A minimum of 5 years of practical experience in a Cybersecurity, Engineering, T&E or A&A (formerly C&A) related field. Must have experience working with Information Assurance tools such as DISA Enterprise Mission Assurance Support Service (eMASS), Assured Compliance Assessment Solution (ACAS) A minimum Top Secret security clearance or higher with the ability to obtain a Top Secret w/ SCI is required to be considered for this position. EDUCATIONAL REQUIREMENTS A college degree in a technical or managerial related discipline is preferred. Note: a high school diploma or high school equivalency certificate is acceptable with 2 additional years of practical experience. CERTIFICATION REQUIREMENTS May be required to hold an Interim Security Control Assessor qualification. Benefits Join PROSYNC and enjoy our great benefits! Compensation We offer sign on bonuses! We also offer bonuses that are awarded quarterly to our employees and our compensation rates are highly competitive. Health & Retirement We offer a comprehensive Health Benefits package and 401K retirement plan so you can take care of yourself and your family, now and in the future. Other health-related benefits include an employee assistance program for those difficult times or when you need to take care of your mental health. Education Individual growth is a priority at ProSync. Employees are encouraged to take advantage of our company-sponsored continuing education program so they can get their degree or that next certification they need to propel them to the next level. Work/Life Balance A healthy work/life balance is essential for building and executing your work effectively at ProSync, but it's also necessary to allow you the room to pursue everything else you want to develop in your personal life. We offer generous Paid Time Off and 11 paid holidays a year. ProSync also provides flexible work options that work with your schedule and lifestyle.