Cloud Security Architect, CISO Support (RMF)

Northramp•Bethesda, MD

11d

About The Position

The Cloud Security Architect supports the Chief Information Security Officer (CISO) for a centralized services contract supporting an HHS client. The cloud broker has more than 1,000 customer environments in Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. The Architect manages the Authorization to Operate (ATO) process under the NIST Risk Management Framework (RMF), maintains controls inherited by customer environments from the broker, and reviews the security architecture of new services before deployment. The role works with the CISO, Authorizing Officials, system owners, Information System Security Officers (ISSOs), assessors, cloud engineers, and customer technical leads. The Architect manages ATO processes for the broker’s authorization boundaries and customer environments, including categorization, control selection and tailoring, implementation, assessment, authorization, and continuous monitoring. The role prepares and tracks authorization documentation, coordinates evidence and schedules, and briefs leadership on authorization status and risks. The Architect defines and maintains inherited-control catalogs and customer responsibility matrices for AWS, GCP, and Azure services. It also reviews service architectures and onboarding requests, establishes reusable documentation and guardrails, checks FedRAMP status, and participates in architecture and change review boards.

Requirements

Bachelor’s degree in information security, computer science, or a related field, or equivalent experience.
6 years of information security experience, including 3 years working on federal ATO packages under the NIST RMF.
Authored SSPs, SARs, and POA&Ms accepted by an Authorizing Official.
Working knowledge of NIST SP 800-53 Rev. 5 control families and common and inherited controls.
Hands-on security architecture experience in at least one of AWS, GCP, or Azure in federal environments, and working knowledge of the other two, including account, subscription, and project structure; identity; network; encryption; and logging.
Experience with FedRAMP-authorized services, FedRAMP baselines, and customer responsibility matrices.
Experience running threat models and architecture reviews with engineers.
Written and spoken communication skills for working with CISOs, Authorizing Officials, assessors, and engineers.
One of the following certifications: CISSP, CCSP, or CISM.
Eligible to work in the United States.

Nice To Haves

Experience supporting a multi-tenant cloud environment with hundreds of accounts and many customers.
Experience building inherited control catalogs, reusable authorization packages, or automated control evidence, including OSCAL.
Experience with GRC tools, ServiceNow, and Splunk for control evidence and monitoring.
Experience writing policy-as-code and infrastructure-as-code guardrails, for example with Terraform.
Experience moving a system boundary from FISMA Moderate to High.
Certifications such as CAP, ISSEP, CISA, AWS Certified Security Specialty, Microsoft Certified Cybersecurity Architect Expert, or Google Professional Cloud Security Engineer.

Responsibilities

Manage the ATO process for broker authorization boundaries and customer environments, including FIPS 199 categorization, control selection and tailoring, implementation, assessment, authorization, and continuous monitoring.
Prepare and track System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and authorization decision packages.
Maintain a schedule and status report for every environment in the authorization process.
Direct continuous monitoring, including annual assessments, significant change reviews, POA&M closure, and vulnerability and configuration findings.
Brief the CISO and Authorizing Officials on authorization status, open risks, and risk acceptance requests.
Align authorization packages with FISMA, NIST SP 800-37 Rev. 2, NIST SP 800-53 Rev. 5, NIST SP 800-53A, FIPS 199 and 200, and FedRAMP baselines.
Coordinate assessors, ISSOs, system owners, and engineers on evidence and schedules.
Define and maintain the catalog of controls inherited by customer environments from the broker’s boundary, landing zones, and shared services across AWS, GCP, and Azure.
Maintain customer responsibility matrices for each cloud provider and service, tied to current FedRAMP authorizations and available federal regions.
Build reusable SSP sections, control narratives, and evidence templates.
Review onboarding requests to determine which controls an environment inherits and which it owns.
Report the share of controls inherited per environment and the time from onboarding request to authorization decision.
Review new services before deployment, including data flows, authorization boundaries, identity and access, network segmentation, FIPS 140 validated encryption, logging, and vulnerability management.
Work with customer technical leads and cloud engineers to select cloud providers and product stacks that meet customer requirements and security controls.
Write a security architecture decision for each new service that identifies required controls, inherited controls, and residual risk before the build starts.
Write reference architectures and guardrails for accounts, subscriptions, projects, landing zones, and policy as code in AWS, Azure, and GCP.
Determine whether a new service fits within the authorized boundary or requires a significant change review.
Check the FedRAMP status of each cloud service before it enters the broker’s service catalog.
Participate in architecture and change review boards.