Senior Cloud Security Engineer

Pantheon Data • Reston, VA

6d • $130,000 - $200,000 • Remote

About The Position

Pantheon Data is seeking a Senior Cloud Security Engineer to own the security architecture, controls, and continuous monitoring of AWS GovCloud environments hosting ML-enabled workloads and applications that process CUI, PII, and PHI. The role designs and implements security guardrails for identity and access, encryption, network security, threat detection, vulnerability management, and evidence supporting ATO and continuous monitoring under FedRAMP High and DoD IL4/IL5.

This is a hands-on engineering role focused on the cloud platform at runtime, rather than policy writing or audit-only work. The engineer partners with the DevSecOps Engineer, who owns CI/CD pipeline security and the software supply chain, and the Cloud Operations Engineer, who builds and runs infrastructure. The Senior Cloud Security Engineer sets security standards and controls for these teams to implement and verifies that the controls operate in production.

The position is remote, with a listed work location of Reston, Virginia. Remote or hybrid employees may periodically work from a Pantheon Data office or client site. Local candidates should be prepared for an in-person interview; candidates outside the local area may be considered for a virtual interview. Candidates must be able to obtain and maintain a Secret clearance; an active Secret clearance is preferred.

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, Engineering, or a related technical field from an accredited university, or equivalent professional experience.
• At least 7 years of hands-on experience in security engineering, cloud engineering, or a closely related role, including at least 3 years securing production AWS environments.
• Deep hands-on experience with AWS identity and access controls, including IAM policy design and troubleshooting, cross-account roles, federated SSO or IAM Identity Center, and organization-level guardrails such as service control policies.
• Experience operating cloud threat detection and security posture tooling, AWS-native or comparable, and turning findings into prioritized, tracked remediation.
• Experience implementing encryption, key management, and network security controls in cloud environments.
• Working understanding of security compliance frameworks and how they translate into technical controls, monitoring, and audit evidence.
• Proficiency with infrastructure as code, with Terraform preferred, sufficient to write, review, and enforce security controls as code.
• Scripting proficiency in Python or Bash for security automation.
• Current security certification such as CompTIA Security+, CISSP, or AWS Certified Security – Specialty.
• Clear written communication, including documenting controls, findings, and remediation guidance for engineers and assessors.
• Ability to work effectively remotely in cross-functional teams.
• Ability to meet deadlines and produce quality work.
• Proficiency in Microsoft Suite software, including Outlook, Word, Excel, SharePoint, and PowerPoint.
• Ability to obtain and maintain a Secret clearance.

Nice To Haves

• Direct experience supporting FedRAMP High or DoD IL4/IL5 ATO efforts, including control implementation statements, SSP contributions, POA&M management, continuous monitoring, and assessor engagement.
• Practical experience applying NIST SP 800-53, DoD RMF, and the DoD Cloud Computing SRG in AWS GovCloud, including DISA STIG and CIS benchmark compliance.
• Certification that satisfies DoD 8140 requirements for privileged cybersecurity roles.
• Experience with SIEM and log analytics platforms such as Splunk, Elastic/OpenSearch, or Amazon Security Lake, including building detections from CloudTrail, VPC Flow Logs, and application logs.
• Container and Kubernetes security experience, including Amazon EKS hardening, pod security standards, image scanning, and runtime protection.
• Experience securing AI/ML workloads, including Amazon Bedrock access controls, data perimeter design for model inputs and outputs, and data exfiltration risks.
• Policy-as-code experience with tools such as OPA, Cloud Custodian, or custom AWS Config rules.
• Experience building automated security response, such as EventBridge- and Lambda-driven remediation.
• An active Secret clearance.

Responsibilities

• Design and enforce least-privilege access across a multi-account AWS organization using IAM Identity Center, role-based access, permission boundaries, and service control policies; conduct periodic access reviews and eliminate long-lived credentials.
• Define and maintain preventive and detective security guardrails as code, including service control policies, AWS Config rules and conformance packs, and organization-wide CloudTrail.
• Operate and tune AWS security services, including GuardDuty, Security Hub, Inspector, Macie, and Detective, and integrate findings and logs with the organization's SIEM.
• Lead investigations and containment of cloud security incidents and maintain incident response runbooks.
• Own encryption and key management strategy, including AWS KMS key policies, rotation, FIPS 140-validated endpoints, and data perimeter controls protecting CUI, PII, and PHI across storage, databases, and Amazon Bedrock access paths.
• Define security group standards, network segmentation, AWS Network Firewall and WAF policies, and restricted-egress boundaries; partner with Cloud Operations to implement them.
• Run continuous vulnerability and configuration scanning across hosts, containers, and cloud resources against DISA STIGs and CIS benchmarks; prioritize findings and track remediation to closure with Cloud Operations and owning teams.
• Map technical controls to NIST SP 800-53; write and maintain control implementation statements; produce continuous monitoring evidence; track POA&M items to remediation; and support assessors during ATO and annual assessment activities.
• Review architectures and infrastructure-as-code changes for security, publish secure baseline patterns, and mentor engineers on cloud security practices.

Benefits

• Competitive salaries and benefits.
• SmartBenefits through the Washington Metro Area Transportation Authority, with a specified amount of pre-tax wages paid directly to a SmarTrip account.
• Tuition assistance may be available for continuing education expenses and certifications related to the position.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior