Cloud Security Architect, CISO Support (RMF)

Northramp LLC•Herndon, VA

12d

About The Position

The Cloud Security Architect supports the Chief Information Security Officer (CISO) on Call Order 1 of the Cloud Professional Support Services (CPSS) contract. The cloud broker has more than 1,000 customer environments across Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. The Architect manages the Authorization to Operate (ATO) process under the NIST Risk Management Framework (RMF), maintains controls inherited by customer environments from the broker, and reviews the security architecture of each new service before deployment. The role works with the CISO, Authorizing Officials, system owners, Information System Security Officers (ISSOs), assessors, cloud engineers, and customer technical leads. It manages ATO activities, continuous monitoring, control inheritability, authorization documentation, and pre-deployment security architecture reviews across cloud environments.

Requirements

Bachelor's degree in information security, computer science, or a related field, or equivalent experience.
6 years of information security experience, including 3 years working on federal ATO packages under the NIST RMF.
Authored SSPs, SARs, and POA&Ms accepted by an Authorizing Official.
Working knowledge of NIST SP 800-53 Rev. 5 control families and common and inherited controls.
Hands-on security architecture experience in at least one of AWS, GCP, or Azure in federal environments, and working knowledge of the other two, including account, subscription, and project structure, identity, network, encryption, and logging.
Experience with FedRAMP-authorized services, FedRAMP baselines, and customer responsibility matrices.
Experience running threat models and architecture reviews with engineers.
Written and spoken communication skills for working with CISOs, Authorizing Officials, assessors, and engineers.
One of the following certifications: CISSP, CCSP, or CISM.
Eligible to work in the United States.

Nice To Haves

Experience supporting a multi-tenant cloud environment with hundreds of accounts and many customers.
Experience building inherited control catalogs, reusable authorization packages, or automated control evidence, including OSCAL.
Experience with GRC tools, ServiceNow, and Splunk for control evidence and monitoring.
Experience writing policy-as-code and infrastructure-as-code guardrails, for example with Terraform.
Experience moving a system boundary from FISMA Moderate to High.
Certifications such as CAP, ISSEP, CISA, AWS Certified Security Specialty, Microsoft Certified Cybersecurity Architect Expert, or Google Professional Cloud Security Engineer.

Responsibilities

Manage the ATO process for the broker's authorization boundaries and customer environments, including FIPS 199 categorization, control selection and tailoring, implementation, assessment, authorization, and continuous monitoring.
Prepare and track System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and authorization decision packages.
Maintain a schedule and status report for each environment in the authorization process.
Direct continuous monitoring, including annual assessments, significant change reviews, POA&M closure, and vulnerability and configuration findings.
Brief the CISO and Authorizing Officials on authorization status, open risks, and risk acceptance requests.
Align authorization packages with FISMA, NIST SP 800-37 Rev. 2, NIST SP 800-53 Rev. 5, NIST SP 800-53A, FIPS 199 and 200, and FedRAMP baselines.
Coordinate assessors, ISSOs, system owners, and engineers on evidence and schedules.
Define and maintain the catalog of controls customer environments inherit from the broker's boundary, landing zones, and shared services in AWS, GCP, and Azure.
Maintain customer responsibility matrices for each cloud provider and service, tied to current FedRAMP authorization and applicable federal regions.
Build reusable SSP sections, control narratives, and evidence templates so customer environments document only controls they implement themselves.
Review onboarding requests to determine which controls each environment inherits and which it owns.
Report the share of controls inherited per environment and the time from onboarding request to authorization decision.
Review each new service before deployment, including data flows, authorization boundary, identity and access, network segmentation, FIPS 140-validated encryption modules, logging, and vulnerability management.
Work with customer technical leads and cloud engineers during onboarding to select cloud providers and product stacks that meet customer requirements and security controls.
Write a security architecture decision for each new service that identifies required controls, inherited controls, and residual risk before the build starts.
Write reference architectures and guardrails for accounts, subscriptions, projects, landing zones, and policy as code in AWS, Azure, and GCP.
Determine whether a new service fits within the authorized boundary or requires a significant change review.
Check the FedRAMP status of each cloud service before it enters the broker's service catalog.
Participate in architecture and change review boards.