Sr. Information Security Engineer, FedRAMP

Consensus Cloud Solutions

11d • $180,000 - $190,000 • Remote

About The Position

The Senior Information Security Engineer for FedRAMP helps maintain Consensus Cloud Solutions’ FedRAMP High compliance and cloud security posture. The role leads and supports Security Operations projects, technical operations, and compliance with NIST 800-53 Rev 5. Responsibilities include supporting annual FedRAMP 3PAO assessments, patching up to 350 servers, managing endpoint protection and backups, conducting vulnerability scans, monitoring logs and intrusions, and assessing AWS GovCloud security. The engineer also manages access controls and user reviews, supports penetration testing and red team exercises, and coordinates with the FedRAMP GRC team on security impact analyses, significant change requests, continuous monitoring, and plans of action and milestones. The role leads incident response and disaster recovery exercises, prepares for annual assessments, supports change management, and mentors other engineers.

The position is fully remote within the United States, with up to 10% travel. It requires reliable high-speed internet and the ability to sit and spend extended periods looking at screens. Employment is contingent on a more extensive federal background check for a Public Trust position. Eligibility requirements include active U.S. citizenship or green-card status, at least three consecutive years residing in the U.S., and a U.S. work location. Sponsorship is not available. The position remains open until a qualified candidate is hired.

Requirements

• At least 5 years of experience in security engineering or a similar technical security role.
• At least 5 years of hands-on cybersecurity experience, including at least 4 years in a security engineering role.
• At least 5 years of experience with vulnerability management tools for identifying, tracking, and mitigating vulnerabilities across systems and applications.
• At least 5 years of experience with endpoint protection tools such as FortiClient EMS, CrowdStrike, Carbon Black, or SentinelOne.
• At least 5 years of experience with cloud service providers and security platforms, including cloud-native application protection and cloud security posture management tools such as AWS Security Hub.
• At least 4 years of experience with AWS security services such as IAM, CloudTrail, GuardDuty, and Security Hub.
• At least 4 years of experience implementing STIGs and baseline configuration management.
• At least 4 years of experience with AWS backup tools such as N2WS Backup.
• At least 4 years of experience with one-time-password systems for secure authentication, such as Okta.
• At least 4 years of experience with SIEM platforms such as Splunk, Elastic, or Exabeam.
• At least 4 years of experience with security monitoring and incident response processes.
• At least 2 years of direct experience supporting FedRAMP, NIST 800-53, or similar government security compliance frameworks.
• Hands-on experience with Nessus, Splunk, Burp Suite, FortiClient EMS, and AWS GovCloud is required.
• Experience applying compliance frameworks to product security, especially in cloud-based and SaaS environments.
• Practical experience performing vulnerability scanning, patch management, and incident response.
• Experience with security compliance frameworks, including NIST 800-53 Rev 5 and FedRAMP.
• Strong analytical thinking, attention to detail, technical proficiency, and problem-solving skills.
• Ability to manage multiple concurrent security projects and meet critical deadlines.
• Ability to communicate technical information clearly to technical and non-technical audiences.
• Ability to adapt to changing threats, technologies, and regulatory requirements.
• Ability to collaborate effectively with cross-functional teams and external vendors.
• Ability to identify opportunities to improve security posture and operational efficiency.
• Ability to provide leadership and mentorship to junior engineers.
• Active U.S. citizenship or green-card status, at least three consecutive years of U.S. residency, and a U.S. work location are required for the federal Public Trust background-check eligibility described in the posting.
• A bachelor's degree in cybersecurity, information technology, computer science, or a related field is preferred; equivalent practical experience will be considered.

Nice To Haves

• Experience supporting or leading FedRAMP High environments or other high-impact government-authorized systems.
• Experience managing Plans of Action and Milestones and working with GRC teams.
• Exposure to penetration testing and red team operations in cloud and hybrid environments.
• Experience automating security tasks using Python, PowerShell, or Bash.
• Knowledge of ticketing and workflow systems such as ManageEngine ServiceDesk Plus.
• Ability to contribute to policy and procedure development and documentation.
• Strong written communication skills for reporting, analysis, and compliance documentation.
• Previous mentorship or leadership experience within a security team.
• Industry certifications such as CISSP, CISM, CEH, Security+, or equivalent.
• Experience supporting or managing a SOC or 24/7 security monitoring environment.
• Ongoing cybersecurity training and continuing education.

Responsibilities

• Provide project management oversight of FedRAMP Security Operations services.
• Support annual FedRAMP 3PAO assessments and security control validation.
• Manage operating-system patching for up to 350 servers.
• Manage antivirus solutions and endpoint security using FortiClient EMS.
• Oversee AWS backup and disaster recovery using N2WS Backup.
• Conduct monthly vulnerability scans across operating systems, databases, containers, web applications, and STIG baselines using Nessus and Burp Suite; provide reporting and analysis.
• Rescan systems to confirm vulnerability remediation.
• Generate monthly security reports and conduct user access reviews.
• Manage and test functional Disaster Recovery and Incident Response plans in accordance with NIST 800-53 Rev 5.
• Operate and maintain SIEM tools such as Splunk for threat detection and correlation.
• Ensure Security Operations Center response SLAs and maintain technical support services with a 15-minute callback SLA.
• Conduct continuous log management and intrusion detection monitoring.
• Perform configuration consistency checks and quarterly authorized-software reviews.
• Review AWS GovCloud security groups and access control lists.
• Administer Active Directory account creation, password resets, and YubiKey setup.
• Manage access to production and pre-production systems and security tools.
• Support and validate annual penetration testing and red team exercises.
• Conduct continuous monitoring and FedRAMP validation scans.
• Coordinate with the GRC team to manage and resolve security impact analyses, significant change requests, and plans of action and milestones.
• Participate in incident response and disaster recovery testing.
• Contribute to annual assessment preparation and significant change management reviews.
• Mentor and guide other security engineers.
• Evaluate security tools and conduct proof-of-concept testing for new technologies.
• Support internal and external security audits beyond FedRAMP, including SOC 2, HITRUST, and PCI.
• Provide input on security policies, procedures, and documentation updates.
• Participate in cross-functional project teams for infrastructure or application changes.
• Deliver internal security awareness or training sessions as needed.
• Research emerging threats, vulnerabilities, and security trends to inform program improvements.
• Assist with vendor risk assessments and third-party security reviews.
• Create and maintain technical runbooks, knowledge base articles, and process documentation.
• Support response efforts for privacy incidents or data breaches involving PII or PHI.
• Participate in industry or government security forums, working groups, or communities of interest.
• Provide backup support for other security team members during absences.
• Perform other duties and responsibilities as required, assigned, or requested.

Benefits

• Annual performance bonus may be included in the total compensation package.
• Employee stock purchase plan (ESPP) may be included in the total compensation package.
• Enhanced time-off packages may be included in the total compensation package.
• Benefits are offered as part of the total compensation package.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior