Cloud Security Engineer / ISSO – Digital Asset Management (Top Secret)

CGI•Fairfax, VA

4d•Onsite

About The Position

Join CGI Federal to support a federal law enforcement client’s classified digital asset modernization initiative. The role safeguards the security, compliance, and operational integrity of a next-generation Digital Asset Management platform across classified and unclassified AWS GovCloud environments. It requires an active Top Secret clearance and involves supporting RMF/ATO activities and advising engineering teams on boundary, identity, and infrastructure protections. The position is located in Washington, DC or Fairfax, VA. The Cloud Security Engineer serves as a security advisor and engineering partner, supporting security design and implementation as well as documentation and ongoing platform sustainment. The role collaborates with engineering, cyber, and security operations teams, and participates in technical exchanges, stakeholder workshops, and planning sessions in secure facilities as needed.

Requirements

At least 6 years of experience in cloud security, cybersecurity, or ISSO-related roles.
Active Top Secret clearance.
Bachelor’s degree in cybersecurity, information systems, computer science, engineering, or a related field; equivalent experience is considered.
Hands-on cloud security engineering experience, especially with AWS IAM, boundary protections, encryption, logging, monitoring, and VPC security.
Strong understanding of the NIST Risk Management Framework and experience supporting ATO packages, including SSPs, POA&Ms, continuous monitoring, and test plans.
Experience with secure cloud enclaves, multi-account structures, or regulated environments such as FedRAMP or GovCloud.
Ability to analyze and interpret security controls and map them to technical implementations.
Understanding of identity and access management, separation of duties, key management, and audit logging requirements.
Experience collaborating with engineering teams to validate secure configurations and support remediation.
Strong communication and documentation skills, including writing security artifacts and presenting findings to technical and nontechnical stakeholders.
Ability to work in structured environments with strict governance, change control, and evidence requirements.

Nice To Haves

Experience supporting high-side deployments, secure enclaves, cross-domain solutions, or classified cloud environments.
Familiarity with container security, including ECS, EKS, or Docker hardening, or secure CI/CD pipelines.
Experience with AWS GovCloud Landing Zone patterns, multi-tenant or multi-agency configurations, or secure data ingestion workflows.
Knowledge of financial system security considerations, digital asset platforms, or blockchain-related security models.
Understanding of vulnerability management tools, security scanning, or compliance automation platforms.
Experience coordinating with ISSOs, ISSMs, cybersecurity teams, or federal law enforcement stakeholders.
Exposure to Zero Trust principles, boundary policy development, or cross-environment security orchestration.

Responsibilities

Advise and partner with engineering teams to support deployment of a Digital Asset Management solution across classified and unclassified AWS GovCloud environments.
Support cloud infrastructure security design, implementation, and documentation, including VPC segmentation, IAM/RBAC models, encryption, monitoring, logging, and boundary protections aligned with federal security controls.
Help develop and refine data transfer models, secure ingestion workflows, approved low-side-to-high-side dataset movement, and cross-domain handling guidance.
Review and validate security-relevant configurations, including SSO federation patterns, RBAC definitions, audit logging, key management, and separation of duties.
Support RMF/ATO activities by developing and maintaining SSPs, configuration documentation, diagrams, security test plans, POA&Ms, and evidence packages.
Conduct security assessments, vulnerability reviews, configuration checks, and security testing with engineering and cyber teams.
Participate in classified-environment readiness activities and ensure infrastructure, configurations, and documentation meet accreditation thresholds.
Monitor security events, identify anomalies, and support incident response with security operations teams.
Guide engineering teams on secure deployment patterns, container hardening, identity controls, and cloud security practices.
Support sustainment through continuous monitoring, boundary rule updates, control assessments, and security-related platform changes.
Participate in technical exchange meetings, stakeholder workshops, and planning sessions within secure facilities as needed.