Consultant, Technical FedRAMP Assessment

Coalfire

3d • $80,000 - $134,000 • Remote

About The Position

Coalfire is seeking a technically strong, self-starting Consultant to join its FedRAMP Assessment team. The role applies detailed technical analysis to federal compliance assessments, including FedRAMP, NIST 800-171, and FISMA. The Consultant reviews system artifacts and independently researches unfamiliar products and settings to determine their significance for control implementation, while developing toward FedRAMP Assessor responsibilities with mentoring from senior assessors.

The Consultant works with assessors, clients, project managers, and other delivery personnel to plan and conduct assessments, evaluate evidence, perform control testing, lead technical walkthroughs, and prepare assessment reports and recommendations. The role also supports client education, quality assurance, timely delivery, customer satisfaction, and ongoing professional development. Travel may be required up to 20%.

Requirements

• At least 2–3 years of experience in a technical IT role, such as systems or network administration, infrastructure engineering, security engineering, or security operations.
• Ability to read and interpret technical artifacts in detail, including configuration files, command-line output, logs, and system settings.
• Self-starter who can independently research configurations and vendor documentation to answer technical questions.
• Strong understanding of networking fundamentals, including TCP/IP, subnetting, routing, VLANs and segmentation, NAT, firewalls and ACLs, ports, and protocols.
• Working knowledge of common infrastructure services and their security, including DNS, DHCP, NTP, directory services/LDAP, authentication and MFA, SSH, TLS and certificates, SMTP, SNMP, syslog, load balancers, proxies, and VPN.
• Working knowledge of Linux and Windows operating system configuration.
• Experience with infrastructure as code, such as Terraform, CloudFormation, or Ansible, and ability to read templates to determine resource configurations.
• Experience with CI/CD pipelines, such as GitHub Actions, GitLab CI, Azure DevOps, or Jenkins, including code review, approval, testing, and deployment processes.
• Scripting experience with tools such as Python, PowerShell, or Bash sufficient to understand scripts and analyze configuration or log data.
• Ability to read and interpret firewall rulesets and network, boundary, and data-flow diagrams.
• Ability to review vulnerability scan output and understand affected components, severity, and remediation.
• Familiarity with NIST Special Publications 800-37 Revision 2, 800-53 Revision 5, and 800-53A Revision 5.
• Ability to independently research technical topics and develop logical testing approaches for validating NIST 800-53 control implementations.
• Ability to help team members collect appropriate artifacts and provide clients with examples of evidence that can satisfy assessment requirements.
• Strong written and verbal communication skills, including explaining technical matters to non-technical audiences.
• Initiative and time-management skills to meet deadlines.
• Strong consulting skills, including the ability to advise and challenge the status quo while building relationships.
• Ability to build high-trust relationships and credibility quickly.
• High attention to detail.
• Ability to facilitate meetings with small or large groups.
• Diplomatic and broad-minded approach.
• Strong technical research skills.
• Bachelor's degree in IT or a related field, or an equivalent combination of education and work experience.
• Willingness to travel up to 20%.

Nice To Haves

• Networking, systems, or cloud security-focused certifications, such as CompTIA Network+, CompTIA Security+, CCNA, AWS, Azure, or CCSK.
• Experience working with technologies hosted in cloud computing environments, such as AWS, Microsoft Azure, Google Cloud Platform, or Oracle Cloud Infrastructure.
• Experience reviewing Nessus or other vulnerability scanner output.
• Prior experience with FedRAMP, FISMA, NIST 800-171, or other security frameworks.

Responsibilities

• Collaborate with assessors on federal compliance assessments, including FedRAMP, NIST 800-171, and FISMA, and assist with assessment planning.
• Review technical artifacts—including configuration files and exports, system and console settings, command-line output, logs, vulnerability scan results, firewall rulesets, and network, boundary, and data-flow diagrams—to determine whether they support stated control implementations.
• Review infrastructure-as-code templates, CI/CD pipeline configurations, and deployment scripts to validate configuration management, change control, and secure baseline enforcement.
• Use scripting to parse and analyze large sets of configuration exports, logs, inventories, and scan data to support control testing.
• Research unfamiliar technologies, products, and configuration settings using vendor documentation, knowledge bases, and hardening guides to determine their function, secure configuration, and relationship to control requirements.
• Analyze network traffic flows and implementation of common services, and identify discrepancies between documentation and actual implementation.
• Evaluate whether artifacts are complete, current, and within the authorization boundary; flag evidence requiring follow-up or clarification.
• Explain to clients when evidence is insufficient and specify what additional evidence is needed and why.
• Review information system security plans to ensure control implementation statements are accurate and supported by technical evidence.
• Lead interview and inquiry walkthroughs, including technical walkthroughs with client engineers and system administrators, to assess conformity with requirements.
• Pursue and corroborate conclusions from inquiry procedures with clients and maintain thorough interview notes.
• Execute, examine, interview, and test procedures in accordance with applicable controls.
• Assess security vulnerabilities against appropriate security frameworks.
• Draft audit observations that address regulatory objectives and the complexity of client environments.
• Conduct first-level reviews of audit planning and reporting materials.
• Prepare and review assessment reports.
• Progressively take ownership of control families and assessment workstreams while developing toward FedRAMP Assessor responsibilities under senior assessors' guidance.
• Educate clients about compliance activities and interpret requirements.
• Manage priorities and tasks to meet delivery utilization targets.
• Deliver quality products and services on time in accordance with Coalfire quality standards.
• Maintain industry-specific certifications, knowledge, credentials, and designations through ongoing professional development.
• Collaborate with project managers, quality management, and delivery team members to meet deliverables and support customer satisfaction.
• Build and maintain positive, collaborative relationships with clients and stakeholders.
• Identify upsell and cross-sell opportunities and escalate them to appropriate leadership.
• Apply quality standards and meet quality assurance benchmarks in all work product documentation and deliverables.
• Advise customers on issues affecting the scope of work in ways that provide additional value.
• Document findings and develop recommendations to improve customers' security posture in accordance with applicable controls.

Benefits

• Flexible work model that may allow employees to choose when and where they work, at home or in an office.
• Employee resource groups and in-person and virtual events.
• Paid parental leave.
• Flexible time off.
• Certification and training reimbursement.
• Digital mental health and wellbeing support membership.
• Comprehensive insurance options.
• Potential eligibility for annual incentive, commission, and/or recognition programs.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level