Technical Consultant – FedRAMP Assessment

This is a fully remote position, open to applicants in United States.

📋 Description

• Collaborate with assessors on federal compliance evaluations, including FedRAMP, NIST 800-171, and FISMA.

• Plan assessment activities for clients.

• Review technical artifacts to assess whether they demonstrate the implementation of controls.

• Examine infrastructure-as-code templates, CI/CD configurations, and deployment scripts.

• Utilize scripting to parse and analyze configuration exports, logs, inventories, and scan data.

• Investigate unfamiliar technologies, products, and configurations using vendor documentation and hardening guides.

• Analyze network traffic flows and the implementation of common infrastructure services.

• Evaluate the completeness, currency, and scope of artifacts.

• Identify inadequate artifacts and communicate the necessary evidence to clients.

• Review information system security plans.

• Lead technical interviews and inquiry walkthroughs with client engineers and administrators.

• Validate inquiry conclusions and maintain comprehensive interview notes.

• Execute examination, interview, and testing procedures.

• Assess vulnerabilities in relation to applicable security frameworks.

• Draft audit findings and assessment reports.

• Review audit planning and reporting materials.

• Progress towards FedRAMP Assessor responsibilities and manage control families under the guidance of a senior assessor.

• Educate clients on compliance activities.

• Manage priorities and delivery utilization targets effectively.

• Deliver high-quality products and services punctually.

• Maintain certifications, credentials, and technical knowledge through ongoing professional development.

• Collaborate with project managers, quality management, and delivery teams.

• Cultivate relationships with clients and stakeholders.

• Identify and escalate opportunities for upselling and cross-selling.

• Apply quality standards to all work products and deliverables.

• Advise customers on scope-related matters.

• Develop documentation and recommendations to enhance customers' security posture.

⛳️ Requirements

• Minimum of 2-3 years of experience in a technical IT role.

• Ability to read and interpret technical artifacts, including configuration files, command-line outputs, logs, and system settings.

• Strong understanding of networking fundamentals, including TCP/IP, subnetting, routing, VLANs and segmentation, NAT, firewalls and ACLs, ports, and protocols.

• Working knowledge of DNS, DHCP, NTP, directory services/LDAP, authentication and MFA, SSH, TLS and certificates, SMTP, SNMP, syslog, load balancers, proxies, and VPN.

• Proficient in Linux and Windows operating system configuration.

• Experience with infrastructure as code tools such as Terraform, CloudFormation, or Ansible.

• Familiarity with CI/CD pipelines, such as GitHub Actions, GitLab CI, Azure DevOps, or Jenkins.

• Scripting experience in Python, PowerShell, or Bash.

• Ability to read and interpret firewall rulesets and network/boundary/data flow diagrams.

• Capability to review vulnerability scan outputs and comprehend affected components, severity, and remediation actions.

• Familiarity with NIST SP 800-37 Revision 2, 800-53 Revision 5, and 800-53A Revision 5.

• Ability to independently research technical topics and develop testing strategies for 800-53 control implementations.

• Ability to assist with artifact collection and provide clients with examples of acceptable artifacts.

• Strong written and verbal communication skills, with the ability to explain technical concepts to non-technical audiences.

• Strong initiative, excellent time management, and ability to meet deadlines.

• Strong consulting skills with the capability to advise and challenge existing practices.

• Ability to quickly build high-trust relationships and credibility.

• High attention to detail.

• Ability to facilitate meetings with both small and large groups.

• Bachelor's degree in IT or a related field, or an equivalent combination of education and work experience.

• Willingness to travel up to 20%.

• Networking, systems, or cloud security certifications are a plus.

• Experience in cloud computing, vulnerability scanning, and familiarity with FedRAMP, FISMA, NIST 800-171, or other security frameworks are additional qualifications.

🏝️ Benefits

• Flexible work model allowing employees to choose when and where they work.

• Paid parental leave.

• Flexible time off.

• Certification and training reimbursement.

• Digital mental health and wellbeing support membership.

• Comprehensive insurance options.

• Employee resource groups.

• In-person and virtual events.

• Equal opportunity and reasonable accommodation.