Note: The job is a remote job and is open to candidates in USA. ZOLL Medical Corporation develops medical devices, software, and services focused on improving outcomes for patients with serious cardiopulmonary and respiratory conditions. The Principal Cloud Engineer will lead cloud infrastructure, platform operations, security, and compliance engineering, with primary responsibility for ZOLL’s FedRAMP authorization initiative. The role also provides technical leadership, mentors engineers, supports observability and SRE practices, and participates in critical incident management.
Responsibilities
- Apply broad expertise across cloud infrastructure, security engineering, and compliance domains to lead and contribute to company objectives in creative and effective ways
- Provide thought leadership on cloud architecture, platform reliability, and regulatory compliance; work on broader organization projects that require understanding of the wider business
- Lead the development of innovative principles, standards, and operational plans for cloud infrastructure that have measurable impact on functional results
- Own collaboration involving coordination among SRE, software engineering, security, compliance, and leadership groups to drive cross-functional alignment
- Communicate with leadership on cloud strategy, FedRAMP readiness posture, and risk decisions; convey advanced technical information and persuade diverse stakeholders
- Work on significant and unique issues where analysis requires evaluation of intangibles; exercise independent judgment in selecting methods, techniques, and evaluation criteria
- Be accountable for results that may impact the entire cloud engineering function
- Provide automated and orchestrated management of all SaaS platforms and technical solutions, driving innovative approaches to unusually complex problems
- Lead AWS and GCP development, maintenance, automation, and orchestration for application pools, websites, data services, virtual networks, security, monitoring, service discovery, and other platform services; ensuring delivery on schedule and in accordance with ZOLL quality standards
- Lead and contribute to the definition of, and enforce patterns, best practices, and strategies for source control structure, branching, and CI/CD across the organization
- Architect and enhance platform services with Terraform, Ansible, Git, Artifactory, Jenkins, Packer, and related tooling
- Define, build, and enhance observability patterns and platforms using OTEL, Coralogix, Grafana, and other tooling
- Define, promote, and maintain SRE best practices across the ZOLL organization and product lines
- Partner with Architects and product development teams within Agile processes to build resilient services and expand ZOLL’s SaaS portfolio
- Serve as the primary cloud engineering lead for ZOLL's FedRAMP authorization initiative, owning the infrastructure and platform compliance workstream
- Lead the documentation and implementation of NIST 800-53 security controls as they apply to cloud infrastructure, with emphasis on the high-friction control families: AC (Access Control), AU (Audit and Accountability), CM (Configuration Management), IA (Identification and Authentication), IR (Incident Response), RA (Risk Assessment), SA (System and Services Acquisition), SC (System and Communications Protection), and CA (Assessment, Authorization, and Monitoring)
- Define and maintain the FedRAMP system boundary documentation, including in-scope services, environments, trust zones, interfaces, and excluded systems
- Own the cloud infrastructure asset inventory—applications, compute, databases, SaaS dependencies, service accounts—with data classification, ownership, and monitoring status for each asset
- Develop and enforce access control models aligned to FedRAMP requirements: user populations, authentication methods, approval workflows, periodic access reviews, separation of duties, and privileged access management
- Collaborate with compliance and security on the vulnerability management program for FedRAMP scope: scanning tools, frequencies, severity handling, remediation SLAs, exception processes, and evidence retention
- Implement and document the logging and audit strategy: log sources, event categories, centralization (OTEL/CloudTrail/VPC Flow Logs), retention periods, access controls, review cadence, alerting, and time synchronization—covering AU-2, AU-6, AU-11, and AU-12 as a cohesive set
- Maintain the external system services register (SA-9) within SRE’s scope: providers, data exchanged, FedRAMP status, shared responsibility assumptions, monitoring expectations, and failure modes
- Define configuration baselines for OS, containers, and cloud configurations; implement drift detection, deviation approval, and hardening aligned to CIS benchmarks
- Establish encryption and key management documentation: data at rest/in transit protections, key ownership, rotation cadence, certificates, approved algorithms, and cryptographic boundaries
- Drive the change management and secure SDLC process for FedRAMP: security gate definitions, approval artifacts, emergency change handling, and retention of evidence
- Own and maintain the FedRAMP gap register and POA&M tracking from the infrastructure perspective, collaborating with security and compliance teams on remediation planning
- Support continuous monitoring activities: monthly vulnerability scanning cadence, POA&M update cycles, annual assessment preparation, and significant change triggers
- Produce and maintain assessor-ready evidence packages: scanner dashboards, ticket queues, remediation records, access review artifacts, configuration audit trails, and log review documentation
- Mentor and develop less-experienced cloud engineers, providing technical guidance, code reviews, and career development support
- May direct the activities of other engineers on complex projects or compliance workstreams
- Collaborate with cross-functional teams to identify areas for improvement and drive innovative solutions
- Participate in critical incident management and root cause analysis, with an after-hours rotation of tier-4 production support
- Contribute to strategic planning for the team and platform, including long-range roadmap and capability investment decisions
Skills
- BA/BS degree in Computer Science, Information Security, or related field, or equivalent experience required
- 7+ years of experience developing production-level applications or automated deployment pipelines using Infrastructure as Code in a public cloud environment (AWS, Azure, GCP) required
- Deep expertise with AWS services (EC2, S3, RDS, Lambda, IAM, CloudWatch, CloudTrail, GuardDuty, VPC, ALB/NLB, CloudFront, Config, etc.)
- Expert-level experience with Infrastructure as Code tools (Terraform, CloudFormation) and configuration management (Ansible)
- Proven experience designing and implementing CI/CD pipelines and release management processes at scale
- Expert-level experience with logging and observability solutions (Coralogix, Splunk, OTEL, Grafana, ELK Stack, CloudWatch) including designing centralized logging architectures
- Strong knowledge of NIST 800-53 security controls and the FedRAMP authorization process, including SSP documentation, continuous monitoring, and POA&M management
- Demonstrated experience with cloud security and governance frameworks: SOC 2, HIPAA, FedRAMP, ISO 27001, CIS Benchmarks, or equivalent federal compliance standards
- Experience defining and documenting system boundaries, data flows, access control models, and security architectures for compliance and audit purposes
- Experience with vulnerability management programs: tool selection, scan scope definition, severity handling, remediation SLA enforcement, and evidence packaging
- Solid understanding of encryption standards, key management practices, and certificate lifecycle management in cloud environments
- Familiarity with ITIL/ITSM processes and proven experience running change management or release management frameworks
- Excellent communication and stakeholder management skills, with demonstrated ability to convey advanced technical and compliance information to leadership and diverse non-technical audiences
- Demonstrated ability to create formal networks across engineering, security, and compliance teams to drive coordinated outcomes
- As required
- Standing - Occasionally
- Walking - Occasionally
- Sitting - Constantly
- Talking - Occasionally
- Hearing - Occasionally
- Repetitive Motions - Frequently
- Meaningful hands-on experience with GCP is strongly preferred
- Experience with TeamCity (build automation) and Artifactory (artifact repository)
- Experience with policy-as-code and governance-as-code platforms (Stacklet, OPA, Sentinel, or similar)
- Familiarity with 3PAO assessment processes and direct experience supporting FedRAMP audits or assessments
- Experience with configuration baseline management and drift detection tooling
- Knowledge of supplier risk management and external services evaluation for federal environments
- 8+ years in a Software Development or Site Reliability Engineering role
- AWS Certified Solutions Architect – Professional certification
- AWS Certified Security – Specialty certification
- AWS Certified DevOps Engineer – Professional certification
- GCP Professional Cloud Architect or Professional Cloud Security Engineer certification
- CISSP, CISM, or other recognized information security certification
- Direct experience achieving or maintaining a FedRAMP authorization
- Experience with Cloud Custodian/Stacklet for multi-account governance and policy enforcement
Benefits
- Hybrid work arrangement
- This position is eligible for an annual bonus in accordance with the company's bonus plan.
- Comprehensive benefits plans
Company Overview