Work Location and On-Site/Telework Requirements: Hybrid – NIH, Bethesda, MD. On site for discovery workshops (typically 1–2 days/week during the first 120 days, then as scheduled).

Citizenship: U.S. Citizenship required

Clearance: All staff must obtain NIH suitability and a PIV credential and be fluent in English. Anyone doing risk or vulnerability testing needs a current T2 (BI) or higher investigation.

Overview:

You will lead Task 3, AI-Enabled Zero Trust Use Case Identification and Development, under the NIH Governance, Risk & Compliance (GRC) Zero Trust Architecture (ZTA) Support Services task order for the NIH Office of the Chief Information Officer (OCIO). Working in the Architecture Pod, you will find where AI can improve Zero Trust policy decisions, design how those signals feed enforcement, and measure whether they are worth deploying. All of this work must fit NIH's AI governance and data-governance requirements.

Responsibilities:

• Lead a six-week discovery with ISAO, GRC, OITA, and CIT to build the AI Use Case Inventory across all ZTA pillars (Subtask 3.1, due at 120 days).
• Score each use case on risk reduction, feasibility with NIH's current telemetry, mission impact, and data-governance readiness, then tier it as deploy now, design next, or watch.
• Record for each use case its NIST AI RMF 1.0 function (Govern, Map, Measure, Manage), data classification, human-in-the-loop requirement, and OMB AI use-case inventory disposition.
• Produce the AI technical architectures (Subtask 3.2): data-flow diagrams; model requirements (inputs, features, retraining cadence, drift thresholds); trust-scoring logic written as policy-as-code that the Policy Engine can consume; and integration patterns for identity-provider risk APIs, endpoint compliance evaluation, network policy controllers, and SOAR playbooks.
• Design use cases such as continuous authentication risk scoring, credential-misuse detection, device risk classification from EDR/MDM telemetry, API and workload-identity anomaly detection, ML classification of PHI/PII/research data, UEBA for insider risk, and AI-assisted SOAR triage.
• Extend Zero Trust to AI agents and copilots: authorization of individual agent actions and tool calls, data-leakage controls, and prompt-injection risk.
• Define and run the Subtask 3.3 measurement protocol (detection rate, false-positive rate, time to detect, analyst hours saved, enforcement latency) in controlled evaluations on NIH telemetry. Recommend whether each capability should enforce or stay advisory.

Tools & Technology Environment: Python, scikit-learn, PyTorch; UEBA and analytics in Splunk/Microsoft Sentinel; identity risk signals (e.g., Microsoft Entra ID Protection); EDR/MDM telemetry (Defender, CrowdStrike); SOAR platforms; Azure AI/AWS SageMaker or Bedrock; policy-as-code (e.g., OPA/Rego).

Required Qualifications:

• Bachelor's degree in computer science, data science, or a related field plus 8+ years of experience, including AI/ML use-case design.
• Experience designing risk or trust-scoring models on security telemetry (identity, endpoint, network, or SIEM data).
• Working knowledge of the NIST AI RMF 1.0 and federal AI governance expectations.
• Hands-on Python and ML framework experience.
• Ability to obtain an NIH suitability determination and PIV credential; fluent in English.

Preferred Qualifications:

• Master's degree; experience with the NIST AI RMF Generative AI Profile and current OMB AI memoranda.
• Familiarity with NIST SP 800-207, MITRE ATLAS, and the OWASP Top 10 for LLM Applications.
• Experience with PHI/PII or health research data governance.
• Security certification (Security+, CISSP) or cloud AI certification.
• Current National Institutes of Health (NIH) or U.S. Department of Health and Human Services (HHS) experience is highly preferred.