Consultant Cybersecurity Compliance & Advisory

SecureIT•Reston, VA

3d•$119,000 - $160,000

About The Position

The Consultant role requires a deep understanding of cloud security frameworks, NIST 800-53 controls, and the overall FedRAMP process. You will work directly with clients to assess their readiness, develop compliance strategies, and guide them through the necessary steps to achieve and maintain FedRAMP certification, FedRAMP equivalency, or GovRAMP authorization. As a trusted advisor, you will work with cross-functional stakeholders including technical teams, security personnel, compliance officers, and executive leadership to ensure strategic alignment and successful execution of engagements. At SecureIT, Consultants have the opportunity to work across a diverse range of engagements, collaborate with colleagues throughout the organization, and gain exposure to different areas of expertise. Our firm-wide staffing model brings together the right talent for each project based on skills, experience, and availability, creating opportunities to broaden capabilities, build relationships, and continuously grow through new challenges. Subject Matter Leadership At SecureIT, Consultants play a pivotal role in driving technical excellence and delivering exceptional client outcomes. As the primary technical and FedRAMP subject-matter resources on assigned engagements, they guide technical execution and solve complex challenges while partnering with Managers on overall project leadership and People Operations on employee lifecycle responsibilities. The Consultant owns: ● Technical and FedRAMP subject-matter guidance delivered to clients on assigned engagements. ● Quality and accuracy of advisory recommendations, gap analyses, and related deliverables. ● Client discussions on complex technical FedRAMP topics, under the Manager’s direction. ● Technical guidance and knowledge-sharing for Associates and Sr. Associates on the engagement. ● Timely escalation of technical, scope, or client-risk concerns to the Manager.

Requirements

6+ years of experience in cybersecurity compliance, risk management, or advisory services within a professional services capacity.
2+ years of experience with FedRAMP engagements.
Strong working knowledge of legacy FedRAMP requirements and NIST 800-53 control families, as well as a good (but growing) understanding of the requirements of the CR26 rules and 20x KSIs.
Understanding of cloud computing technologies (AWS, Azure, and/or GCP).
Experience advising on cloud architecture, security configurations, and compliance best practices.
Familiarity with container security, Infrastructure as Code, boundary protection, FIPS-validated encryption, phishing-resistant MFA, DNSSEC, and other modern cybersecurity mechanisms and technologies.
Strong communication skills to explain complex compliance and security concepts to non-technical stakeholders.
Ability to present solutions clearly and confidently to C-level executives and technical teams.
Strong analytical and problem-solving skills to assess complex security and compliance challenges and provide practical solutions.
Effective time management skills and an ability to adapt in a rapidly changing environment.
Strong writing and documentation skills.
Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or a related field; advanced degrees are a plus.
At least one industry-recognized certification, such as CISSP, CCSP, CCSK, CCAK, and/or hyperscaler-specific certifications (e.g., AWS, Azure, GCP).

Nice To Haves

advanced degrees are a plus

Responsibilities

Participate in discussions with clients regarding key, complex, and technical FedRAMP areas (e.g., container security, boundary protection, FIPS 140 validated encryption, phishing-resistant MFA, and DNSSEC).
Analyze system boundaries and advise clients in accordance with FedRAMP rules, or where appropriate, DoW FedRAMP equivalency or GovRAMP requirements.
Provide technology-specific guidance and advice for commonly used cloud platforms (e.g., AWS, Azure, GCP), technologies (e.g., Windows, Unix, Docker, Kubernetes), and security tools (e.g., Okta, Wiz, Splunk, etc.).
Explain the requirements of applicable CR26 rules, identify gaps in CSP processes, and suggest corrective actions.
Review CSP-defined KSI metrics to identify gaps (or identify control gaps for rev5 baseline engagements) and provide recommendations for client remediation.
Document the CSP’s implementation of CR26 rules and KSIs (or rev5 controls) for the SDR, including identifying appropriate verification and validation procedures and required artifacts.
Apply a “what-will-assessors-look-for?” lens to make sure that CSP artifacts will withstand scrutiny by assessors (as well as by the PMO and agency customers).
Advise clients on navigating FedRAMP’s certification processes, including timelines and Continuous Monitoring (ConMon) expectations.
Help clients plan for, establish, and execute regular ConMon processes, such as ongoing vulnerability management following the VDR/VER and additional CR26 processes.
Provide subject-matter guidance on complex ConMon and ongoing reporting issues in CR26, and where appropriate, assist in their performance.
Support team members on FedRAMP requirements, cloud architectures, DevSecOps, and security tools and technologies.
Contribute lessons learned, templates, and technical guidance to service-line playbooks.
Perform deep technical research on specific matters as directed by SMEs or the CKO.