Senior Information Security Engineer, FedRAMP

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee project management for FedRAMP Security Operations services

• Assist with annual FedRAMP 3PAO assessments and validation of security controls

• Manage operating-system patching for up to 350 servers

• Handle antivirus and endpoint security management utilizing FortiClient EMS

• Supervise AWS backup and disaster recovery processes with N2WS Backup

• Execute monthly vulnerability scans using Nessus and Burp Suite, which include OS, database, container, web application, and STIG baseline scans

• Conduct remediation rescans and generate detailed reports and analyses

• Create monthly security reports and perform user access reviews

• Administer and test Disaster Recovery and Incident Response plans in accordance with NIST 800-53 Rev 5

• Operate and maintain SIEM tools like Splunk for threat detection and correlation

• Ensure adherence to SOC response SLAs and provide technical support with a 15-minute callback SLA

• Execute continuous log management and intrusion detection monitoring

• Perform configuration consistency checks and conduct quarterly reviews of authorized software

• Manage security groups and access control lists for AWS GovCloud

• Administer Active Directory accounts, including password resets and YubiKey configurations

• Control user access in production, pre-production, and security systems

• Provide support for annual penetration testing and red team exercises

• Carry out continuous monitoring and FedRAMP validation scans

• Collaborate with the GRC team on Security Impact Assessments (SIAs), Security Change Requests (SCRs), and Plans of Action and Milestones (POAMs)

• Engage in Incident Response and Disaster Recovery testing

• Contribute to preparation for annual assessments and reviews of Significant Change Management

• Mentor and guide fellow security engineers

• Assess security tools and perform proof-of-concept evaluations

• Assist with both internal and external security audits, including SOC 2, HITRUST, and PCI compliance

• Provide input regarding security policies, procedures, and documentation

• Participate in cross-functional infrastructure and application change initiatives

• Deliver security awareness and training sessions

• Investigate emerging threats, vulnerabilities, and security trends

• Support vendor risk assessments and third-party security evaluations

• Maintain technical runbooks, knowledge base articles, and process documentation

• Assist in response efforts for privacy incidents or data breaches involving PII/PHI

• Participate in industry and government security forums

• Offer backup support for fellow security team members

⛳️ Requirements

• A Bachelor's degree in cybersecurity, information technology, computer science, or a related field is preferred; equivalent practical experience will be considered

• A minimum of 5 years of experience in security engineering or a comparable technical security role

• At least 5 years of hands-on cybersecurity experience, including a minimum of 4 years in a security engineering position

• Over 5 years of experience with vulnerability management tools such as Nessus Pro, Burp Suite, and SonarCube

• More than 5 years of experience with endpoint protection tools like FortiClient EMS, CrowdStrike, Carbon Black, or SentinelOne

• At least 5 years of experience with cloud service providers and security platforms, including AWS Security Hub

• Minimum of 4 years of experience with AWS security services such as IAM, CloudTrail, GuardDuty, and Security Hub

• 4+ years of experience implementing STIGs and managing baseline configurations

• 4+ years of experience using AWS backup and disaster recovery tools like N2WS Backup

• 4+ years of experience with one-time password systems like Okta

• 4+ years of experience with SIEM platforms such as Splunk, Elastic, or Exabeam

• At least 4 years of experience with security monitoring and incident response processes

• 2+ years of direct experience supporting FedRAMP, NIST 800-53, or similar government security compliance frameworks

• Required hands-on experience with Nessus, Splunk, Burp Suite, FortiClient EMS, and AWS GovCloud

• Familiarity with applying compliance frameworks to product security initiatives in cloud-based and SaaS environments

• Practical experience in vulnerability scanning, patch management, and incident response

• Familiarity with cloud security, preferably AWS GovCloud or other regulated cloud environments

• Basic understanding of GDPR, CCPA, and NIST compliance frameworks

• Experience with NIST 800-53 Rev 5 and FedRAMP security compliance frameworks

• Strong technical proficiency with security tools, AWS GovCloud, and enterprise IT infrastructure

• Capability to manage multiple concurrent security projects and meet deadlines

• Ability to effectively communicate technical information to both technical and non-technical audiences

• Reliable, high-speed internet is required

• Must be able to sit for extended periods and handle prolonged screen time

• Active U.S. citizenship or green card holder residing in the U.S. for a minimum of 3 consecutive years

• Must satisfactorily complete an extensive Federal Government background check for a Public Trust Position

• Must be eligible to work in the U.S.; sponsorship is not available

🏝️ Benefits

• Annual performance bonus

• Employee Stock Purchase Plan (ESPP)

• Enhanced time off packages

• Comprehensive benefits

• Fully remote work within the U.S.

• Up to 10% travel

• Requirement for reliable, high-speed internet for remote work