Search Jobvertise Jobs
Jobvertise

FedRAMP Cyber Security Engineer
Location:
US-WA-Leavenworth
Jobcode:
S1698268401823
Email this job to a friend

Report this Job

Report this job





Incorrect company
Incorrect location
Job is expired
Job may be a scam
Other







Apply Online
or email this job to apply later

Responsibilities

Are you a Cloud Computing and Cyber Security professional? Are you looking to make an impact across the entire federal government? Do you have NIST Risk Management Framework (RMF) knowledge andexperience? Do you love researching new technologies and capabilities? Are you self-driven and detailoriented with excellent written and verbal skills? Then this job is for you. Come be a part of a rapidly growing team of highly skilled FedRAMP cyber security SMEs and help redefine the FedRAMP process.

FedRAMP Cyber Security Engineers are FISMA, NIST RMF and FedRAMP subject matter experts. We review security packages to evaluate compliance with FedRAMP security requirements and ensure package deliverables clearly and accurately represent the security and risk posture of the cloud service offering. FedRAMP Cyber Security Engineers review the system architecture, authorization boundary, data flows, security controls, and the results of an independent security assessment to determine suitability for government-wide use. Cyber Security Engineers work with the FedRAMP team to advise on new and emerging technologies with an emphasis on security impact. We are seeking qualified individuals to be FedRAMP SMEs and develop government-wide guidance.

Key Responsibilities:
  • Perform compliance reviews of cloud service offering (CSO) system security plans (SSPs) to ensure the security posture is sufficient for multi-agency USG use
  • Provide risk-based guidance to cloud service providers (CSPs) to address areas found to be non-compliant
  • This position focuses on the architecture portion of the SSP, and requires the successful candidate to:
    • Interpret multiple graphic representations of a CSO detailing aspects such as the boundary, encryption status, and subnet architecture
    • Compare implementation stated in SSP to other documents in the overall compliance package such as an auditor's security assessment report (SAR)
    • Clearly document review findings with guidance to CSPs for remediation in a templated report
    • Work hand-in-glove with a team of SMEs that are performing the same level of review on other portions of the compliance package
    • Operate in a high-visibility environment where your judgement will:
      • Have significant impact on cybersecurity for the USG
      • Be scrutinized in detail, first by your colleagues within the program, and then by external stakeholders
      • Be completely supported by the program when finalized
  • Organizationally, day-to-day activities require:
    • Maintaining focus on the highest priority package at hand
    • Rapidly shifting focus to support stakeholder review meetings to present your findings
    • Daily reporting of package status to coordinate multiple teams reviewing multiple packages
    • Contributing to, and following, detailed standard operating procedures to ensure:
      • Firm, fair, and consistent reviews from one package to the next
      • Secure handling of sensitive and proprietary vendor data
      • Coordination of document revision control with your team members
  • Exceptional candidates will have experience in several of the following areas of compliance focus:
    • FIPS 140 validated encryption addressing data at rest, data in transit, and MFA authenticators
    • Human-to-machine authentication based on NIST SP 800-63-3
    • Familiarity with service offerings from hyperscale IaaS/PaaS vendors such as AWS, Azure, Google, IBM, and Oracle such as:
      • How a vendor implements TCP/IP constructs within their respective software defined networking (SDN) architectures
      • Which NIST SP 800-53 controls are deployed for customers by default, versus requiring customer configuration, or entirely a customer responsibility
      • Aspects of DNS including DNSSEC, typical configurations for DDoS protection, DNS over TLS (DoT), and DNS over HTTPS (DoH)
      • Domain-based Message Authentication, Reporting & Conformance (DMARC) for email
    • Research evolving Federal policy and guidance for application to FedRAMP initiatives and cloud service reviews
    • Develop policy/guidance for new/emerging technologies


Qualifications

Required Qualifications:
  • Bachelors degree in technology related field with 8+ years of experience reviewing or developing IT security and compliance documentation (NIST or FedRAMP). Or Masters + 6 years of experience. Work experience can be substituted with commensurate experience Experience performing risk assessments and analyzing risk
  • Understanding of government cryptography requirements
  • Strong understanding of cloud architecture, various cloud technologies, and security concepts
  • Strong understanding of networking principles and security best practices
  • Strong analytical and writing skills
  • Strong technical research skills
  • Strong communication skills and ability to explain complex technical concepts to non-technical stakeholders
  • Excellent teamwork, organizational, communication, and collaboration skills
  • US citizen and eligible for public trust
Desired Qualifications:
  • At least four (4) years of experience in the IT Security frameworks (FedRAMP, NIST, DoD CMMC, etc.)
  • Application development
  • Security testing and penetration testing experience
  • Vulnerability management experience
  • API development and security practices
  • Experience developing enterprise security policies and procedures
  • OSCAL experience
  • ISSP, CISA, CISM or similar certifications
  • Experience with operating system or network security management Experience managing incident response and after-action remediation
  • Post graduate degree in computer science, cybersecurity or information systems


Client Engagement
Support and lead evolving business development efforts by applying technical and functional expertise to develop business solutions.
Lead proposal sections for small or limited competition proposals and actively participate in teaming strategy discussions

Overview

Noblis and our wholly owned subsidiaries, Noblis ESI, and Noblis MSD tackle the nation's toughest problems and apply advanced solutions to our clients' most critical missions. We bring the best of scientific thought, management, and engineering expertise together in an environment of independence and objectivity to deliver enduring impact on federal missions. Noblis works with a wide range of government clients in the defense, intelligence and federal civil sectors. Learn more at Noblis -About Us

Why work at a Noblis company?

Our employees find greater meaning in their work and balance the other things in life that matter to them. Our people are our greatest asset. They are exceptionally skilled, knowledgeable, team-oriented, and mission-driven individuals who want to do work that matters and benefits the public. Noblis has won numerous workplace awards. Noblis maintains a drug-free workplace.

Noblis

Apply Online
or email this job to apply later



Senior Cyber Security Engineer
  Click here
Malden, MA
Job Description SummaryThe Cybersecurity Team is part of Bentley Information Technology which is the central provider of technology infrastructure, se...
Posted about a month ago



Software Engineer Cyber Security SME K
  Click here
Herndon, VA
Cyber Security Developer to implement and maintain custom software tools and techniques using C and Python. Developers will reverse engineer intermedi...
Posted about a month ago



Cyber Security Engineer - Onsite
  Click here
San Francisco, CA
Cyber Security Engineer San Francisco, CA (Onsite, No Remote) Contract (C2C/W2) 3 References are must for this role Description: The District is looki...
Posted about a month ago



Remote Senior Cyber Security Engineer
  Click here
Seattle, WA
...
Posted about a month ago



Sr Cyber Security Engineer hybrid
  Click here
Los Angeles, CA
Sr. Cyber Security Engineer Contract position in Los Angeles, CA Skills Qualifications Proposed Contractor(s) must have the following minimum qualific...
Posted about a month ago


 
Search millions of jobs

Jobseekers
Employers
Company

Jobs by Title | Resumes by Title | Top Job Searches
Privacy | Terms of Use


* Free services are subject to limitations