Cloud Security & Compliance Specialist (15.43)

OCT Consulting, LLC • Hyattsville, MD

14h • $90,000 - $110,000 • Hybrid

About The Position

OCT Consulting is seeking a Cloud Security & Compliance Specialist to support a federal client. This role will assist the ISSO/SSPO with cloud security operations, FedRAMP-related support, and information security compliance for cloud-hosted and modernized IT environments. The position is contingent upon contract award.

Requirements

• Must be a U.S. Citizen.
• Minimum of 3–5 years of experience in cloud security, federal information security compliance, or cybersecurity operations.
• Demonstrated experience with cloud security governance, cloud migration security support, and/or FedRAMP-related activities.
• Experience with NIST SP 800-53, 800-37, and FedRAMP security control baselines.
• Experience performing vulnerability management, compliance scanning, and POA&M tracking in federal environments.
• Familiarity with SCAP-compliant automated tools for vulnerability scanning, configuration management, and asset management.
• Experience with Governance, Risk, and Compliance (GRC) platforms such as Archer or comparable tools.
• Strong technical writing skills sufficient to independently produce clear, accurate, and professionally formatted security and compliance documentation.
• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, Cloud Computing, or a related field (or equivalent work experience).
• Ability to obtain a Public Trust (Moderate Risk – Level 5 or higher) background investigation; an HSPD-12/PIV card will be required for facility and network access.

Nice To Haves

• Certified Cloud Security Professional (CCSP), Certified Information Systems Security Professional (CISSP), Certified Authorization Professional (CAP), or equivalent certification.
• Experience supporting HHS or other Federal civilian agency cloud environments (AWS GovCloud, Azure Government).
• Experience with FedRAMP third-party assessment organization (3PAO) processes or JAB authorization activities.
• Familiarity with CIPSEA requirements, Privacy Act compliance, and handling of sensitive federal health statistics data.
• Experience with EPLC security reviews and federal IT acquisition security processes.

Responsibilities

• Support client cloud migration efforts and IT modernization initiatives from an information security governance perspective, ensuring alignment with existing cloud architectures (AWS, Azure) and EPLC requirements.
• Assist in cloud security operations including FedRAMP-related SA&A support, continuous monitoring, and maintaining security authorizations for cloud-hosted and FedRAMP-aligned systems.
• Conduct vulnerability and compliance reporting: analyze scan results, identify critical/high vulnerabilities, and provide actionable remediation recommendations; submit monthly reports to the COR.
• Support POA&M development, tracking, and monthly updates for cloud-hosted and contractor-hosted systems; ensure all findings are tracked and reflect current remediation status.
• Assist with Security Assessment and Authorization (SA&A) package development and coordination including SSPs, RARs, POA&Ms, Contingency Plans, and E-Authentication assessments.
• Support compliance with FedRAMP security control baselines, NIST SP 800-53, FISMA, OMB Circular A-130, and applicable agency cloud security policies.
• Assist in reviewing and validating ISSO intranet content and security resources; prepare intranet content review reports.
• Develop and maintain the Security Authorization Boundary Inventory & Strategy Report, assessing system inventory and recommending optimized authorization boundaries.
• Participate in EPLC security reviews and IT acquisition security reviews related to cloud-based solutions and modernization efforts.
• Prepare ad hoc technical support deliverables for cloud migration support, acquisition security reviews, and other RMF-related activities as requested.
• Support development and maintenance of security training materials for client staff and stakeholders; assist with training delivery as needed.
• Ensure HSPD-12/PIV requirements, FIPS 140-2 encryption standards, and CUI handling requirements are met across cloud-operated systems.
• Maintain compliance with all agency security training requirements including annual Security Awareness Training (SAT) and role-based training (RBT).

Benefits

• Medical, Dental, and Vision insurance
• Retirement savings 401K plan provided by an industry leading provider with 3% employer contributions of the employee's gross salary
• Paid Time Off and Standard Government Holidays
• Life Insurance, Short- and Long-Term disability benefits
• Training Benefits

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level