Cloud Compliance Officer

Koniag Government Services•Washington, DC

9d•Hybrid

About The Position

Koniag Technology Solutions, Inc a Koniag Government Services company, is seeking a Cloud Compliance Officer with a Secret security clearance to support KTS and our government customer in Washington, DC. The position is onsite with possibly hybrid availability. This position is for a Future New Business Opportunity. This position is covered under the Service Contract Act. We offer competitive compensation and an extraordinary benefits package including health, dental and vision insurance, 401K with company matching, paid holidays, paid Vacation, paid sick leave and more. Koniag Government Services is seeking an experienced Cloud Compliance Officer to join our team supporting compliance and security operations across multi-cloud environments including Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). The ideal candidate is a detail-oriented professional with a strong background in cloud security frameworks, regulatory compliance, and risk management, committed to ensuring our cloud infrastructure meets all applicable federal and industry standards. The ability to obtain or maintain an active Secret clearance is required to support our government customer. The Cloud Compliance Officer will be responsible for overseeing, managing, and continuously improving compliance posture across AWS, Azure, and GCP cloud environments. This individual will serve as a subject matter expert on cloud security and regulatory requirements, working closely with engineering, security, and leadership teams to ensure all cloud-based systems and services adhere to applicable laws, regulations, and organizational policies.

Requirements

Bachelor's degree in Information Technology, Cybersecurity, Computer Science, Information Systems, or a related field from an accredited college or university.
5+ years of experience in IT compliance, cybersecurity, or cloud security roles.
3+ years of hands-on experience working with compliance and security controls across two or more major cloud platforms (AWS, Azure, GCP).
Demonstrated experience with federal compliance frameworks including FedRAMP, NIST SP 800-53, and FISMA.
Active Secret clearance or higher (Top Secret preferred).
Exceptional communication skills in English – both written and oral – with the ability to effectively communicate compliance requirements and risks to both technical and non-technical stakeholders.
In-depth knowledge of cloud security and compliance frameworks including FedRAMP, NIST SP 800-53, NIST CSF, HIPAA, SOC 2 Type II, and ISO 27001.
Demonstrated ability to assess and audit cloud environments across AWS, Azure, and GCP for security misconfigurations and compliance violations.
Proficiency with cloud-native compliance and security tools such as AWS Security Hub, AWS Config, Microsoft Defender for Cloud, Azure Policy, and Google Cloud Security Command Center.
Experience authoring and maintaining compliance documentation including SSPs, POA&Ms, security control assessments, and risk assessment reports.
Strong understanding of Identity and Access Management (IAM) principles, least privilege, and role-based access control (RBAC) in cloud environments.
Familiarity with DevSecOps practices and the ability to integrate compliance controls into CI/CD pipelines and infrastructure-as-code (IaC) workflows.
Experience with data classification, data residency requirements, and cloud data governance practices.
Ability to coordinate and manage audit processes, including evidence collection, stakeholder communication, and remediation tracking.
Ability to work both independently and collaboratively in a cross-functional team environment.

Nice To Haves

Experience supporting FedRAMP Authorization to Operate (ATO) processes, including working with Third Party Assessment Organizations (3PAOs).
Familiarity with cloud automation and scripting tools (e.g., Terraform, Python, PowerShell) for compliance monitoring and remediation tasks.
Knowledge of Zero Trust Architecture principles and their application in multi-cloud environments.
Experience with Security Information and Event Management (SIEM) platforms and log aggregation tools in cloud environments.
One or more of the following certifications: AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, Google Professional Cloud Security Engineer, Certified Cloud Security Professional (CCSP), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), CompTIA Cloud+.
Experience with container security and compliance in Kubernetes-based environments (e.g., EKS, AKS, GKE).
Prior experience in a federal government IT environment or supporting government cloud compliance programs.

Responsibilities

Develop, implement, and maintain cloud compliance programs across AWS, Azure, and GCP environments in alignment with applicable regulatory frameworks (e.g., FedRAMP, NIST, HIPAA, SOC 2, ISO 27001).
Conduct continuous monitoring and auditing of cloud infrastructure to identify compliance gaps, security risks, and policy violations.
Collaborate with cloud engineers, architects, and DevSecOps teams to embed compliance controls into cloud-native design and deployment processes.
Assess and document cloud service configurations, access controls, and data handling practices to ensure alignment with organizational and regulatory standards.
Lead and coordinate internal and external cloud compliance audits and assessments, including preparation of evidence packages and remediation plans.
Maintain and update System Security Plans (SSPs), Plan of Action and Milestones (POA&Ms), and other compliance documentation as required.
Monitor evolving regulatory requirements and cloud provider policy updates, communicating impacts and required actions to relevant stakeholders.
Develop and deliver compliance training and awareness materials for technical and non-technical staff.
Serve as the primary point of contact for cloud compliance inquiries from internal teams, government customers, and third-party auditors.
Partner with the Security Operations team to investigate and respond to cloud compliance incidents and policy violations.
Evaluate third-party cloud tools and services for compliance risk prior to adoption.