FedRAMP 20X Advisory Senior Consultant

Fortreum•Leesburg, VA

3d•$150,000 - $193,000•Hybrid

About The Position

Fortreum is a trusted leader in cloud and cybersecurity services, ranked among the Top 5 FedRAMP Third Party Assessment Organizations (3PAO). With the addition of Kovr.AI, we have expanded our capabilities to include advanced cyber risk quantification and analytics, enabling organizations to better understand, measure, and communicate risk. Together, we deliver independent, third-party, vendor-agnostic regulatory assessment and advisory services, alongside advanced cybersecurity offensive and compliance technical solutions. Our comprehensive service portfolio spans regulatory compliance frameworks including FedRAMP, CMMC, FISMA, SOC, PCI, ISO, and HIPAA. Working with Fortune 500 companies and leading cloud service providers, we’ve built our reputation on service-delivery excellence and an unwavering commitment to client success. Our continued rapid growth creates exceptional opportunities for driven professionals to make their mark in the cybersecurity industry—guided by our core values: quality above all, a customer-driven mindset, autonomy, and personal accountability. The Senior Consultant, FedRAMP 20x Advisory leads projects evaluating the security and compliance of client firms against regulatory and industry requirements and standards, as well as security best practices. This is an engineer-minded, hands-on role: you will design solutions mapped to FedRAMP 20x Key Security Indicators (KSIs), build validation approaches that demonstrate control satisfaction through code and automation rather than static documentation, and develop reports and documentation for clients.

Requirements

Bachelor’s Degree or equivalent job experience
6+ years of professional services experience
4+ year of FedRAMP experience or cloud security engineering experience
Working knowledge of FedRAMP 20x KSIs
Comfort using AI tools to interpret and organize regulatory requirements
Active GitHub or portfolio showing coding/cloud automation work
Proficient in Microsoft 365 product suite
Ability to be self-directed with little oversight
Ability to quickly assess new and leading-edge technologies and concepts
Ability to develop and maintain strong relationships with team members and clients
Comfortable supporting fast-paced team environments
Strong technical acumen with regards to cloud security

Nice To Haves

Experience with Infrastructure-as-Code (Terraform) and scripting/automation
Looking to achieve AWS Solutions Architect or Security Specialty (or Azure / GCP equivalent)
Familiarity of testing in Cloud environments (previous 3PAO experience)
Experience writing scripts or building integrations for continuous compliance monitoring/validation
Interest in deepening cloud engineering skills (AWS/Azure/GCP) beyond a compliance-only background

Responsibilities

Deliver gap analysis and detailed program recommendations for clients pursuing a regulatory or compliance milestone
Prepare for FedRAMP 20x Vulnerability Detection & Response (VDR)
Advise on FIPS 140-2 / 140-3 Encryption
Develop & Maintain FedRAMP Authorization Boundary Diagram
Optimize Management Plane Tooling (SIEM, Vulnerability Management, etc.)
Develop documentation such as a Security Decision Record (SDR) and Certification Package Overview (CPO)
Design and implement client solutions mapped to FedRAMP 20x Key Security Indicators (KSIs), translating outcome-based requirements into technical architecture rather than narrative documentation
Build and support automated, code-based validation methods (scripts, APIs, Infrastructure-as-Code) so clients can demonstrate continuous control satisfaction instead of point-in-time screenshots
Track FedRAMP 20x releases and Change Requests (e.g., CR26) on an ongoing basis and translate new guidance into practical client recommendations
Use AI/ML tools to catalog Key Security Indicators and help clients and internal teams navigate evolving requirements efficiently
Advise CSPs on generating machine-readable visibility into their own compliance data, giving them stronger grounds to defend risk-based decisions to assessors
Establishes and maintain positive collaborative relationships with clients and stakeholders
Advises clients on compliance activities and their desired outcomes
Leads project activities including preparation, review of documentation and artifacts, evaluation of procedures, and client interviews
Ensures quality products and services are delivered on time and within allotted hours
Continuous professional development in pursuing industry specific certifications
Escalates client and project issues to management in a timely manner to inform and engage the necessary resources to address the issue
Provides mentorship to team members
Interfaces with clients through entire engagement, interacting will all levels of client organizations
Pursue industry specific certifications and seek continuous professional development