Separate admin of a security profile from assigning a security profile to an asset

Would like to be able to have someone be able to assign the security profiles to assets within ADMM (i.e. Rules, etc.) but not able to change the security profile within admin.

I would like to have developers be able to set the security profile to a rule without being able to see or edit the roles connected to that security profile.