Note: The job is a remote job and is open to candidates in USA. Peraton is a national security and enterprise IT company delivering mission-focused solutions and technologies. The Senior Cloud Engineer will lead the transformation of audit, risk, and compliance operations by building cloud-based automation, continuous monitoring, security documentation, compliance reporting, and governance processes.
Responsibilities
- Own the organization's full audit and assessment calendar, ongoing/continuous control assessments, financial and IT-financial audits, internal controls testing, and security compliance audits (e.g., SOC 1 Type II). Serving as the primary point of contact for external auditors and assessors
- Lead recurring meetings and working sessions with the client, auditors, and assessors across the audit lifecycle: kickoffs, evidence walkthroughs, interviews, findings reviews, and status updates. Represents the organization’s control environment directly to external stakeholders
- Provide audit support across the full assessment portfolio, including penetration testing, red/purple/white team exercises, and periodic CISA high-value-asset assessments, incorporating all findings into the risk register and remediation lifecycle
- Support new system authorization (ATO) and periodic reauthorization efforts, coordinating required documentation and evidence on a recurring cycle
- Own ongoing maintenance of the System Security Plan (SSP): control implementation updates, system and technical descriptions, and review of inherited/tailored controls against the NIST 800-53 baseline. Validating control descriptions against the actual cloud architecture and configuration, not just the paper record
- Lead the annual review and executive sign-off cycle for core security documentation and review the organization's control catalog for accuracy against how the environment is built and configured
- Own the annual review, update, and test cycle for business continuity and resilience documentation: business impact analysis, contingency plans, disaster recovery plans, and incident response plans. Grounded in the actual failover, backup, and recovery architecture of the cloud environment, not generic templates
- Lead recurring privacy impact/threshold assessments in coordination with the privacy function, including technical review of how architecture handles the data in scope
- Own recurring compliance reporting deliverables: inventory reports, compliance scorecards, SLA and audit-performance metrics, progress reports, and build the automation that generates them directly from the cloud environment (native services, APIs, infrastructure-as-code state) rather than manual collection
- Design, build, and maintain automated evidence-collection and continuous-monitoring pipelines using native cloud services and scripting/IaC, reducing manual, screenshot-based collection across the full audit and reporting calendar above
- Identify the highest-value recurring manual processes across audit, documentation, and reporting work, and personally build the automation to address them. This role is expected to build, not just spec and hand off
- Maintain governance documents that codify the organization's security and audit-support processes
- Serve as the point of contact for ad hoc security and privacy inquiries and impact-analysis requests from system and business owners
- Lead recurring coordination meetings with system owners, risk management, and compliance stakeholders to maintain shared visibility into audit status, findings, and remediation
Skills
- Must be a U.S. Citizen with the ability to obtain and maintain the required Public Trust level clearance
- Bachelors Degree and 12 years of experience, a Masters Degree and 10 years of experience, or a High School diploma or equivalent and 16 years of experience
- 10+ years of combined experience across cloud engineering and GRC/IT audit/information security compliance, with genuine hands-on depth in both
- Demonstrated experience building or maintaining cloud infrastructure and automation (IaC, scripting, cloud-native tooling) in a production environment
- Demonstrated experience serving as the primary point of contact between technical teams and external auditors or assessors, and owning security documentation (e.g., SSP) and control implementation
- Experience managing findings and remediation from audits, penetration testing, or red/white team engagements through to closure
- A portfolio or concrete example of a manual compliance or reporting process the candidate personally automated is a strong plus
- Frameworks: NIST 800-53, NIST CSF, A-123, FISMA, and SOC 1/2 Type 2
- One or more of the following relevant certifications: AWS Certified Solutions Architect, AWS Certified Security - Specialty, CISSP, CISA, CRISC, or CGRC
- Bachelors Degree in Computer Science, Cybersecurity, Information Systems, or a related field
Benefits
- Work Location: Remote
- Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
Company Overview