Job Title: IT - Information Assurance/Security Engineer II
Location work will be performed: MDT101 - MD B1 - Teleworker
Job Responsibilities:
• Assess each candidate agentic AI vendor against security posture, data-handling, and ATO requirements as part of the vendor-list assessment.
• Author the security-and-compliance inputs to the POC Solution proposal: control inheritance, boundary definition, data-flow diagrams, and the compliance narrative for the vendor-isolated exclusive environment.
• Coordinate with the FPS ISSO/ISSM and security stakeholders to keep AI tool assessment and POC activity inside the FPS ATO boundary.
• Own compliance artifacts and cadence (SSP inputs, POA&M entries, PIA/SORN as applicable) for the AI vendor-evaluation effort.
• Serve as the single point of contact for security-and-compliance questions raised by third-party vendors, or the Peraton PM.
• Discuss with the Lead AI Solutions Architect on LLM/agentic-AI-specific compliance concerns (model-provider data retention, prompt/response logging, PHI-in-prompt controls, tool authorization).
Qualifications:
• Working knowledge of security frameworks: CFACTS, CSRAP, and the ATO lifecycle (SSP, SAR, POA&M, contingency plan, PIA/SORN).
• Practical experience with FISMA / NIST SP 800-53 control tailoring, inheritance from cloud providers (AWS FedRAMP baselines), and boundary definition.
• Experience assessing third-party/vendor security posture: SOC 2, FedRAMP, HIPAA/HITRUST, penetration-test evidence, vulnerability management.
• Working knowledge of HIPAA PHI handling and Federal PII requirements, especially for Medicare/Medicaid claims data.
• Ability to author security artifacts and briefings for -level review/ clear technical writing required.
Education/Experience:
• Bachelor’s degree in an IT-related discipline.
• 2-4 years experience with security compliance work
Preferred Quals:
• CISSP, CISM, CAP, CISA, or equivalent certification.
• Prior compliance work on the FPS ATO or another ATO'ed system (IDR, One PI, UCM).
• Familiarity with security considerations specific to LLM and agentic AI systems (model-provider data retention, prompt logging, MCP tool authorization, RBAC for LLM outputs).
• Experience defining vendor-isolated enclaves inside a Federal customer's authorization boundary.
