The SCAR will perform reviews of security artifacts for system authorizations, assessing both the technical and functional adequacy as required for application and software cybersecurity readiness.

Key Responsibilities:

• Evaluating IT infrastructure in terms of risk to the organisation and defining artifacts required to meet Federal, DoD and DAF requirements
• Assessing IT systems and architecture to ensure compliance with the Risk Management Framework (RMF), NIST Cybersecurity Framework (CSF), NIST 800-53 revision 5 and applicable guidance
• Supporting the system/application assessment and authorization (A&A) effort, to include assessing and guiding the quality and completeness of A&A activities, tasks and resulting artifacts mandated by governing DoD and AF policies, and applicable mandates
• Collecting, reviewing and verifying documented business processes within process narratives or flowcharts, identifying risks and validating proficiency of mitigating controls
• Reviewing risk and control matrices and testing plans for key controls and determines effectiveness
• Identifying control gaps, reviewing and testing the design of existing controls
• Formulating clear and concise conclusions on internal controls and business process efficiency
• Recommending policies and procedures to ensure information systems reliability and accessibility and to prevent and defend against unauthorized access to systems, networks, and data
• Conducting risk and vulnerability assessments of installed information systems to identify vulnerabilities, risks, and protection needs
• Reviewing Plans of Actions & Milestones (POA&Ms)
• Providing recommendations and reports to the Security Control Assessor (SCA), Authorizing Official (AO), Chief Information Security Officer (CISO)
• Reviewing network and systems design to ensure accuracy
• Ensuring the rigorous application of information security/cybersecurity policies, principles, and practices in the delivery of all IT services

Required Qualifications:

• 5+ years of relevant Cyber experience
• 5+ years prior experience as a Security Control Assessor/Representative RMF Engineer, ISSO, ISSM and/or information assurance engineer
• Cloud Platform experience with at least one service offering from AWS, Azure, or Google GCP
• Hands-on eMASS and/or Xacta experience completing full system lifecycle activities
• Experience with Air Force risk management policies/procedures, to include, DODI 8510.01, AFI 17-101
• Experience with Cloud Computing Security Requirements Guide (CC SRG)
• Knowledgeable with DoD DevSecOps Fundamentals Playbook
• Experience evaluating information security compliance against STIGs
• Ability to clearly articulate ideas
• Strong technical writing abilities to author reports for AO and CISO dissemination
• Exudes confidence in providing briefings, presentations, and in conducting/guiding meetings with senior leadership and stakeholders
• Ability to use prior experience and knowledge to address new situations
• Certification requirements (at least one of the following): SecurityX / CASP+, CCISO, CGRC/CAP, CISA, CISM, CISSO, CISSP, CISSP-ISSEP, Cloud+, CySA+, FITSP-A, GCSA, GSEC, GSLC, GSNA, PenTest+, Security+
• B.A. or B.S. Information Security, Computer Science or related discipline
• US Citizenship and currently possess a Top Secret security clearance

Job Data by YubHub.

Key Responsibilities:

• Deploy and maintain common Kubernetes platform services on cloud-native architecture
• Integrate a Kubernetes platform with common enterprise services to satisfy organisational security requirements
• Implement secure automation, effective monitoring, and Infrastructure as Code
• Deploy and maintain Continuous Integration/Continuous Delivery (CI/CD) pipelines across multiple environments
• Support and work alongside a cross-functional engineering team on the latest technologies
• Develop and iterate best practices to increase the quality and velocity of deployments
• Implement industry best practices for system hardening and configuration management

Required Qualifications:

• 8+ years of experience working with commercial cloud service providers such as AWS, GCP, or Azure with at least 2 years of specific experience working in cARMY, Cloud One, or Platform One at IL6
• Experience architecting and maintaining common Kubernetes or Docker platform services on cloud-native architecture, ensuring high availability and scalability for mission-critical applications
• Experience integrating and providing cloud platform services within a Kubernetes cluster
• Experience designing and implementing Infrastructure as Code (IaC) solutions using Terraform to enforce DISA STIG compliance and baseline configuration management across all environments
• Experience with DevSecOps tools and processes such as GitLab CI, Artifactory, ArgoCD, FluxCD, Helm, Kustomize
• Experience deploying and maintaining Continuous Integration/Continuous Delivery (CI/CD) pipelines across multiple environments
• Demonstrated knowledge in Agile, Scrum, DevSecOps processes, and DoD cybersecurity requirements
• Solid problem-solving skills, attention to detail, and critical thinking abilities
• B.A. or B.S. in Computer Science, Information Systems, Computer Engineering, or related discipline (or relevant experience in lieu of a degree)
• DoD Approved 8570 Baseline Certifications (e.g. CompTia Security+ CE Certification)
• US Citizenship and an active DoD Secret security clearance or higher

Desired Qualifications:

• Experience with Oracle and PostgreSQL DBMS
• Experience deploying and maintaining Platform One’s Big Bang suite of tools
• Experience working with the DHA
• Experience with DoD FedRAMP authorised cloud platforms such as AWS GovCloud and/or Cloud One
• Experience standing up and maintaining AWS services including RDS, EMR, ECR, EKS and S3
• Experience deploying Kubernetes using Rancher RKE2
• Knowledge of the Risk Management Framework (RMF) accreditation process and security requirements
• Experience using DISA enterprise security products including HBSS and ACAS and performing security hardening to satisfy STIG requirements
• Experience installing and configuring a service mesh for cluster ingress/egress, mTLS, and authorisation and authentication of services
• Experience providing Identity Management services within a cloud or Kubernetes environment such Open ID Connect (OIDC) or SAML SSO

The compensation for the senior level role is estimated to be approximately $155,000.00 -$185,000.00 commensurate on experience.

Job Data by YubHub.

This individual will be responsible for navigating the RMF lifecycle, developing security documentation, conducting risk assessments, and ensuring that systems meet the highest standards of security and compliance.

Key Responsibilities:

• Concentrate on overall technical and operational effectiveness of capabilities in coordination with the COTR and Sponsor Staff management.
• Provide recommendations on continuous improvement of processes and architectures supporting Cyber Defense operational activities, including analysis, incident handling, and reporting products.
• Ensure effective operations of Agency IT systems and network defenses, providing incident response capabilities and usable reports that address situational awareness.
• Maximize the use of existing tools to correlate information and synthesize data into actionable events.
• Identify and provide an agile approach to automating manual and inefficient processes across the cyber defense program.

Required Qualifications:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related technical field.
• 8 years minimum of relevant experience.
• Experience in security risk assessment and management in cloud environments (GCP preferred).
• Experience building authorization packages.
• US Citizenship required with an active Secret clearance or interim Secret clearance.

This role is primarily remote. The compensation for this role is estimated to be between $150,000-$170,000, commensurate on experience.

Job Data by YubHub.

Working at the intersection of cybersecurity engineering, cloud architecture, and DevSecOps prototyping, you will evaluate security controls for cutting-edge AI/LLM technologies across multiple classification levels.

This position is ideal for a pragmatic cloud assessor or SCAR who excels in fast-paced DevSecOps environments, understands AWS cloud security, and is eager to shape the cybersecurity posture of next-generation DoD AI capabilities.

Key Responsibilities

• Execute formal SCA/R duties.
• Lead security assessment efforts, establishing reusable security playbooks and assessment frameworks for rapid AI deployment into enterprise workflows.
• Evaluate technical control effectiveness across AWS cloud infrastructure, DevSecOps pipelines, microservices, containerized workloads, and GenAI/LLM application stacks.
• Partner directly with cybersecurity engineering and DevSecOps prototyping teams to integrate security controls early in the development lifecycle.
• Review, author, and maintain assessment packages,including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and POA&Ms,tailored to rapid prototyping and AI systems.
• Assess technical security risks specific to AI/LLM implementations, such as API exposure, vector database access controls, model integration surface area, and software supply chain dependencies.
• Support continuous monitoring (ConMon), technical risk evaluations, and cloud architecture reviews across multi-tenant, multi-classification environments.
• Coordinate with Authorizing Officials (AOs), program managers, and engineering leads to deliver decision-ready risk briefings and ATO recommendations.
• Provide technical input and oversight for cybersecurity engineering and penetration testing activities across prototype projects.

Required Qualifications

• Active Top Secret security clearance
• Current DoD 8570/8140 IAM Level II or Level III certification (e.g., Security+, CySA+, CISM, CISSP, CCISO, CAP/CISC)
• 3–5+ years of experience conducting security control assessments, compliance testing, or A&A/RMF activities for DoD or federal information systems
• Solid operational understanding of core AWS cloud services (EC2, S3, IAM, VPCs, Security Groups, Security Hub) and how security controls function within cloud-native and CI/CD pipeline environments.
• Strong working knowledge of NIST SP 800-53 (Rev. 4/5), NIST SP 800-37 (RMF), DoD Cloud Computing SRG, and FedRAMP baselines.
• Demonstrated experience writing and evaluating core RMF artifacts (SSPs, SAPs, SARs, POA&Ms)
• Exceptional written and verbal communication skills, with the ability to articulate technical risk clearly to executive stakeholders, Authorizing Officials, and engineering teams.
• Hands-on experience navigating government GRC repositories, such as eMASS or XACTA.

Desired Qualifications

• Hands-on experience mapping security controls to the NIST AI Risk Management Framework (AI RMF), the OWASP Top 10 for LLM Applications, or the DoD Responsible AI (RAI) Guidelines.
• Familiarity evaluating secure design patterns for autonomous AI Agents (e.g., tool-calling permissions, sandboxing agent execution environments, prompt boundaries, and ReAct/LangGraph architectures).
• Experience assessing cloud-managed AI ecosystems and foundation model platforms (e.g., AWS Bedrock, AWS SageMaker, Hugging Face Enterprise, or self-hosted open-source models).
• Understanding of data protection, access controls, and boundary security for RAG pipelines and vector databases (e.g., OpenSearch Vector Engine, Pinecone, Milvus, or PostgreSQL pgvector).
• Familiarity evaluating risks unique to LLMs,including prompt injection, data poisoning, model inversion, insecure output handling, and open-source supply chain vulnerabilities in AI libraries (PyTorch, LangChain, LlamaIndex).
• Exposure to LLM guardrail platforms, evaluation frameworks, or AI security tools (e.g., Promptfoo, Garak, Giskard, NeMo Guardrails) used to test model robustness and output safety.
• Experience with cATO methodologies, Infrastructure as Code (IaC) templates (Terraform, CloudFormation), and container security (AWS EKS/ECS, Docker).
• Active AWS Certifications (e.g., AWS Certified Security – Specialty or AWS Certified Solutions Architect).
• Background or familiarity with offensive security, penetration testing

The salary range for this position is estimated to be between $135,000.00 - $160,000.00, commensurate on experience and technical skillset.

Job Data by YubHub.

Working at the intersection of cybersecurity engineering, cloud architecture, and DevSecOps prototyping, you will evaluate security controls for cutting-edge AI/LLM technologies across multiple classification levels.

This position is ideal for a pragmatic cloud assessor or SCAR who excels in fast-paced DevSecOps environments, understands AWS cloud security, and is eager to shape the cybersecurity posture of next-generation DoD AI capabilities.

Key Responsibilities

• Execute formal SCA/R duties.
• Lead security assessment efforts, establishing reusable security playbooks and assessment frameworks for rapid AI deployment into enterprise workflows.
• Evaluate technical control effectiveness across AWS cloud infrastructure, DevSecOps pipelines, microservices, containerized workloads, and GenAI/LLM application stacks.
• Bridge the gap between OffSec and development by applying software design best practices.
• Lead technical exchange meetings (TEMs), participate in Discovery & Framing workshops, and maintain effective communication with cross-functional teams and stakeholders.
• Act as the primary subject matter expert and lead developer for custom offensive tooling, integrating disparate capabilities into a cohesive, mission-ready platform.
• Review, author, and maintain assessment packages,including System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), and POA&Ms,tailored to rapid prototyping and AI systems.
• Assess technical security risks specific to AI/LLM implementations, such as API exposure, vector database access controls, model integration surface area, and software supply chain dependencies.
• Support continuous monitoring (ConMon), technical risk evaluations, and cloud architecture reviews across multi-tenant, multi-classification environments.
• Coordinate with Authorizing Officials (AOs), program managers, and engineering leads to deliver decision-ready risk briefings and ATO recommendations.
• Provide technical input and oversight for cybersecurity engineering and penetration testing activities across prototype projects.

Required Qualifications

• Active Top Secret security clearance
• Current DoD 8570/8140 IAM Level II or Level III certification (e.g., Security+, CySA+, CISM, CISSP, CCISO, CAP/CISC)
• 5–7+ years of experience conducting security control assessments, compliance testing, or A&A/RMF activities for DoD or federal information systems
• Solid operational understanding of core AWS cloud services (EC2, S3, IAM, VPCs, Security Groups, Security Hub) and how security controls function within cloud-native and CI/CD pipeline environments.
• Experience with GitLab CI/CD (pipeline design, runners, artifact management) and AWS Cloud services (EC2, VPC, IAM, S3).
• Strong working knowledge of NIST SP 800-53 (Rev. 4/5), NIST SP 800-37 (RMF), DoD Cloud Computing SRG, and FedRAMP baselines.
• Demonstrated experience writing and evaluating core RMF artifacts (SSPs, SAPs, SARs, POA&Ms)
• Exceptional written and verbal communication skills, with the ability to articulate technical risk clearly to executive stakeholders, Authorizing Officials, and engineering teams.
• Hands-on experience navigating government GRC repositories, such as eMASS or XACTA.

Desired Qualifications

• Hands-on experience mapping security controls to the NIST AI Risk Management Framework (AI RMF), the OWASP Top 10 for LLM Applications, or the DoD Responsible AI (RAI) Guidelines.
• Familiarity evaluating secure design patterns for autonomous AI Agents (e.g., tool-calling permissions, sandboxing agent execution environments, prompt boundaries, and ReAct/LangGraph architectures).
• Experience assessing cloud-managed AI ecosystems and foundation model platforms (e.g., AWS Bedrock, AWS SageMaker, Hugging Face Enterprise, or self-hosted open-source models).
• Understanding of data protection, access controls, and boundary security for RAG pipelines and vector databases (e.g., OpenSearch Vector Engine, Pinecone, Milvus, or PostgreSQL pgvector).
• Familiarity evaluating risks unique to LLMs,including prompt injection, data poisoning, model inversion, insecure output handling, and open-source supply chain vulnerabilities in AI libraries (PyTorch, LangChain, LlamaIndex).
• Exposure to LLM guardrail platforms, evaluation frameworks, or AI security tools (e.g., Promptfoo, Garak, Giskard, NeMo Guardrails) used to test model robustness and output safety.
• Experience with cATO methodologies, Infrastructure as Code (IaC) templates (Terraform, CloudFormation), and container security (AWS EKS/ECS, Docker).
• Active AWS Certifications (e.g., AWS Certified Security – Specialty or AWS Certified Solutions Architect).
• Background or familiarity with offensive security, penetration testing

The salary range for this position is estimated to be between $135,000.00 - $160,000.00, commensurate on experience and technical skillset.

Job Data by YubHub.

Responsibilities include:

• Providing oversight and enforcement of DoD and Air Force Cyber Security policies and procedures
• Acting as the primary security advisor to the PM, AO, and ISO
• Ensuring compliance with established information security AF requirements
• Overseeing an ISSO Team

Requirements:

• 3 years' experience as an ISSM or 5 years' experience as a Sr. ISSO
• Hands-on experience enforcing information protection policies in an unclassified environment
• Excellent written and verbal communication skills
• At least one of the following cyber security certifications: CASP+, CE/Security X, or CISSP
• Strong experience with DoD and Air Force Risk Management Framework (RMF)
• Proficiency with a major cloud services platform (GCP, Azure, AWS, etc.)
• Bachelor's Degree in Computer Science, Business, or a related field
• Proficiency with Microsoft Office software suite
• U.S. Citizenship with an active Secret security clearance

Desired Qualifications:

• Experience with task management, metrics collection, and status reporting to management
• Proficiency with Google Cloud Platform (GCP) technology
• Demonstrated knowledge/experience in resource allocation, workload management, and contract management
• One or more of the following cyber security certifications: SEC+, SSCP, CASP, GSEC, GICSP, CEH, CDNA, CSSLP
• Experience with common security tools such as Nessus, WASSP, SECSCN, and/or MBSA

The salary range for this position is $140,000.00 - $160,000.00, commensurate with experience and technical skillset.

Job Data by YubHub.

The team provides support to enhance and develop new data applications, modernizing capabilities through an agile process. This position is a hybrid onsite located in Tampa, FL.

Required Qualifications:

• Bachelor’s degree in IT, Computer Science, Mathematics, or equivalent technical area; or 3 years of equivalent industry experience.
• Strong experience with Kubernetes orchestration, including continuous delivery using Helm Charts and/or Argo CD.
• Extensive knowledge of DevOps practices, including microservices architecture, CI/CD pipelines, cloud architecture, and infrastructure as code.
• Ability to convey complex ideas through conversation, briefings, and writing with clear, concise language.
• DOD 8570 LVL II Certification, such as Comptia Security+.
• US Citizenship and ability to be clearable up to the Top Secret clearance with SCI eligibility.

Desired Qualifications:

• Experience architecting and deploying enterprise-grade AWS cloud infrastructure via Infrastructure as Code, with a focus on version management, automated patch management, disaster recovery, and high availability.
• Previous experience developing software in an Agile environment, including applied experience with the Scaled Agile Framework (SAFe) and PI planning.
• Certification in cloud architecture with AWS, CKA, CKAD, GCP, or Azure.

The estimated compensation range for this role is $150,000.00 - $180,000.00, commensurate with experience and technical skill set.

Job Data by YubHub.

The role will function as an operator responsible for hands-on incident response, correlation, and threat detection both on-premise using ELK and across AWS GovCloud environments using Splunk Enterprise.

Key Responsibilities:

• Active monitoring, detection, and analysis across on-prem (ELK) and cloud-hosted AWS GovCloud (Splunk Enterprise) environments.
• Utilize AI-assisted analysis, automation, and correlation of data from various log sources to triage security events, detect anomalies, and reduce response times for complex threats.
• Vulnerability Management actions to include providing recommendations and implementing mitigations.
• Conduct intrusion analysis and correlation of unauthorized activities; provide and implement recommendations to improve detection and customer mitigation processes.
• Participate in the Root Cause Analysis process and documentation capturing efforts taken to mitigate unauthorized actions.
• Participate in the development of DCO tactics, techniques, and procedures (TTPs) and supporting documentation.
• Identify security discrepancies and report and respond to security incidents.
• Provide research and analysis in support of expanding programs and areas of responsibility.
• Draft documentation for briefings, reports, and informational analyses.
• Participate in customer exercises (after duty hours may be required).
• Adhere to defined policies, master plans and schedules.
• Complete all initial and annual training requirements and disclosures as outlined by BSTG.
• Perform all other duties as required, consistent with the goals, objectives, and responsibilities of the department.

Required Qualifications:

• 4+ years of relevant cybersecurity experience, including direct SOC / vSOC / CSSP incident response experience.
• 2+ years of hands-on experience using Splunk Enterprise and ELK Stack (Elasticsearch, Logstash, Kibana) for event correlation and threat detection.
• Direct experience monitoring, ingesting, and analyzing security telemetry within AWS GovCloud environments (e.g., CloudTrail, VPC Flow Logs, AWS GuardDuty).
• Hands-on experience utilizing GitLab (e.g., source control, CI/CD pipelines, issue tracking, or DevSecOps workflows).
• 2+ years of experience with employment of DoD cybersecurity requirements, policies, and procedures to include assessment and authorization activities.
• Department of Defense Directive (DoDD) 8140 / 8570 IAT CSSP Certification must be obtained prior to hire (CEH, Security+, GCIH, CySA+ or Equivalent).
• Bachelor’s degree in Computer Science, Information Technology, or a related field.
• US Citizenship and an active Top Secret/SCI security clearance required.

Desired Qualifications:

• Experience with AI/ML security tools (e.g., generative AI for query generation, automated threat intelligence, or AI-driven behavioral analytics).
• AWS Certified Security – Specialty certification.
• Splunk Core Certified Power User / Admin or Elastic Certified Analyst certifications.
• Experience writing search queries using SPL (Splunk Processing Language) and KQL/Lucene (Kibana Query Language).
• Experience with SentinelOne (or similar EDR platforms) for endpoint detection, threat hunting, and automated remediation.
• Familiarity with Infrastructure-as-Code (IaC) tools such as Terraform or Ansible within a DevSecOps environment.
• Experience performing cybersecurity activities in support of software and system requirements, design, development, testing, and sustainment.
• Experience with HBSS, ACAS, SCAP Compliance Checker (SCC), DISA STIGs.
• Working knowledge of NIST 800-53 Security and Privacy Controls.
• Experience with various operation systems such as RHEL and Windows.
• Experience in performing post-incident computer forensics without destruction of critical data.
• Ability to provide guidance on DoD Cyber regulations and requirements to engineering and software development staff.

The estimated salary range for this role is $90,000.00 - $145,000.00, commensurate on experience and technical skillset.

Job Data by YubHub.

This individual will be responsible for navigating the RMF lifecycle, developing security documentation, conducting risk assessments, and ensuring that systems meet the highest standards of security and compliance.

This position offers a critical opportunity for a motivated and detail-oriented security professional to leverage their RMF expertise, contribute to the protection of sensitive information, and play a vital role in securing the nation's critical infrastructure.

Key Responsibilities:

• Concentrate on overall technical and operational effectiveness of capabilities in coordination with the COTR and Sponsor Staff management.
• Provide recommendations on continuous improvement of processes and architectures supporting Cyber Defense operational activities, including analysis, incident handling, and reporting products.
• Ensure effective operations of Agency IT systems and network defenses, providing incident response capabilities and usable reports that address situational awareness.
• Maximize the use of existing tools to correlate information and synthesize data into usable and actionable events.
• Identify and provide an agile approach to automating manual and inefficient processes across the cyber defense program.

Required Qualifications:

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related technical field.
• 5 years minimum of relevant experience.
• Experience in security risk assessment and management in cloud environments (GCP preferred).
• Experience building authorization packages.
• US Citizenship required with an active Secret clearance.

This role is primarily remote, with a hybrid schedule, and based out of any Dark Wolf Office location.

The compensation for this role is estimated to be between $120,000-$150,000, commensurate on experience.

Job Data by YubHub.