Principal Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Offer technical knowledge on the implementation of security controls and create information security protocols for systems and applications.

• Conduct pre-assessment tasks, including thorough analysis of technology stacks that involve vendor solutions.

• Evaluate vendor systems for technical adherence to NIST, FedRAMP, and agency standards.

• Execute comprehensive architecture and technical design reviews across the entire stack for vendor solutions.

• Perform architecture assessments of CSP authorization packages to confirm secure design, alignment with FedRAMP and agency standards, identify deficiencies, and provide guidance on risk posture and compliance.

• Facilitate architecture discussions with CSPs to ensure essential control areas meet program specifications.

• Create architecture briefing documents for the Government FedRAMP program manager and CISO.

• Review and provide feedback on CSP FedRAMP documentation, which includes system security plans, policies, procedures, supplemental guidance, alternative implementations, and risk acceptance documents.

• Collaborate with CSPs to address documentation and technology discrepancies.

• Analyze CSP assessments and package submissions following 3PAO audits and prepare package briefings.

• Examine vendor security assessment plans, security assessment reports, vulnerability scans, and penetration tests.

• Deliver security engineering services in conjunction with the agency FedRAMP Lead.

• Support Continuous Monitoring efforts, including yearly package submissions, significant change proposals, and risk acceptance documents.

• Interpret FedRAMP and agency requirements, providing vendors with technical and procedural guidance.

• Remain updated on new FedRAMP guidance, industry best practices, emerging technologies, and Government cybersecurity directives.

• Advise on the implications of updated guidance and technologies to the FedRAMP Government Lead.

• Conduct security evaluations of technologies intended for use within CSP authorization parameters.

• Manage relationships for assigned contractor-owned or contractor-operated systems and ensure vendor adherence to security and privacy regulations.

• Assist stakeholders with IT security initiatives and project timelines.

• Ensure systems are operated, maintained, and disposed of in compliance with established security policies and procedures, including Assessment & Authorization.

• Investigate assigned IT security systems and offer architecture and security recommendations.

⛳️ Requirements

• Minimum of five (5) years of experience in the IT Security domain.

• Bachelor’s degree in Computer Science, Information Systems, Mathematics, Engineering, or a related field, OR an additional three years of IT experience.

• Direct experience as a Security Engineer or System Architect conducting analyses on FedRAMP Cloud Service Providers (CSP) architectures and control implementations.

• Four (4) years of practical technical experience as a System Architect or Security Engineer.

• Four (4) years of experience supporting FedRAMP as an Engineer or Architect.

• Security+, CISSP, CISM, CISA, or equivalent Security certification.

• Confidence and a comprehensive understanding to lead discussions with potential Vendors.

• Current experience in evaluating third-party security assessment reports.

• In-depth knowledge and experience with NIST Policies, Governance, Security Planning and Architecture, FISMA Compliance, RMF, Incident Analysis, and General Security Best Practices.

• Excellent written and verbal communication skills.

• Ability to engage with both technical and non-technical stakeholders, senior management, junior staff, business unit customers, and public audiences.

• Must be legally authorized to work in the United States.

• Capable of obtaining and maintaining a Public Trust clearance.

• A quiet, distraction-free workspace with reliable internet for telework.

• Full attention and availability during working hours, aligning schedules with coworkers and clients.

• Disclosure of current or future outside employment and written consent for outside professional activities.

🏝️ Benefits

• A selection of medical plans, ranging from an economical HSA option to a comprehensive PPO, with generous company contributions.

• Dental and vision coverage for you and your family.

• Company-paid life, short-term disability, and long-term disability insurance.

• Optional supplemental life, accident, and critical illness insurance.

• 401(k) retirement plan with company matching.

• Paid time off that increases with years of service.

• Paid federal holidays.

• Coverage for certifications and professional development.

• Access to the Valiant University training portal.

• Flexible spending accounts.

• Wellness and fitness program.

• Referral bonuses.

• Flexible remote work arrangements.

• Reasonable accommodations for qualified individuals with disabilities.