Note: The job is a remote job and is open to candidates in USA. Consensus Cloud Solutions is hiring a Senior Information Security Engineer for FedRAMP to maintain FedRAMP High compliance and strengthen its cloud security posture. The role leads FedRAMP security operations, supports assessments and vulnerability management, and oversees incident response, disaster recovery, and security controls in AWS GovCloud.
Responsibilities
- Provide project management oversight of FedRAMP SecOps services
- Support Annual FedRAMP 3PAO assessments and security control validation
- Perform patch management for operating systems on up to 350 servers
- Manage antivirus solutions and ensure endpoint security using FortiClient EMS
- Oversee AWS backup and disaster recovery using N2WS Backup
- Conduct monthly vulnerability scans (OS, database, containers, web apps, STIG baseline) using Nessus and Burp Suite tools and provide reporting and analysis
- Perform rescans to confirm remediation of vulnerabilities
- Generate monthly security reports and conduct user access reviews
- Manage and test functional Disaster Recovery and Incident Response plans per NIST 800-53 Rev 5
- Operate and maintain SIEM tools such as Splunk for threat detection and correlation
- Ensure Security Operations Center (SOC) response SLAs
- Maintain technical support services with a 15-minute callback SLA
- Perform continuous log management and intrusion detection monitoring
- Conduct configuration consistency checks and quarterly authorized software reviews
- Manage AWS GovCloud security groups and access control list reviews
- Administer Active Directory account creation, password resets, and YubiKey setup
- Manage user access for production and pre-production systems, as well as security tools
- Support and validate annual penetration testing and red team exercises
- Conduct continuous monitoring (ConMon) and FedRAMP validation scans
- Collaborate with the GRC team to manage and resolve SIAs, SCRs, and POAMs
- Participate in Incident Response and Disaster Recovery testing activities
- Contribute to Annual Assessment preparation and Significant Change Management reviews
- Mentor and guide other security engineers
- Assist with evaluating security tools and conducting proof-of-concept testing for new technologies
- Support internal and external security audits beyond FedRAMP (e.g., SOC 2, HITRUST, PCI, etc.)
- Provide input on security policies, procedures, and documentation updates
- Participate in cross-functional project teams for infrastructure or application changes
- Deliver internal security awareness or training sessions as needed
- Research emerging threats, vulnerabilities, and security trends to inform program improvements
- Assist in vendor risk assessments and third-party security reviews
- Create and maintain technical runbooks, knowledge base articles, and process documentation
- Support response efforts for privacy incidents or data breaches involving PII/PHI
- Participate in industry or government security forums, working groups, or communities of interest
- Provide backup support for other security team members during absences
- Perform other duties and responsibilities as required, assigned, or requested. Consensus reserves the right to add or change duties at any time
Skills
- 5+ years of experience in security engineering or a similar technical security role
- 5+ years of hands-on experience in cybersecurity, with at least 4 years in a security engineering role
- 5+ years of experience with Vulnerability Management tools for identifying, tracking, and mitigating vulnerabilities across systems and applications. Such as Nessus Pro, Burp Suite, and SonarCube
- 5+ years of experience using Endpoint Protection tools like FortiClient Enterprise Management Server (EMS), CrowdStrike, Carbon Black, or SentinelOne to monitor and protect endpoints against threats
- 5+ years of experience with Cloud Service Providers and their Security platforms, including cloud-native application protection, cloud security posture management in tools such as AWS Security Hub
- 4+ years of experience with AWS security services such as IAM, CloudTrail, GuardDuty, and Security Hub
- 4+ years of experience implementing Security Technical Implementation Guides (STIGs) and baseline configuration management
- 4+ years of experience with AWS backup tools such as N2WS Backup for AWS backup and disaster recovery
- 4+ years of experience with One-time password systems for secure authentication, such as Okta
- 4+ years of experience with SIEM (Security Information and Event Management) platforms, such as Splunk, Elastic, or Exabeam, for detecting, analyzing, and responding to security incidents
- 4+ years of experience with Security Monitoring and Incident Response processes, such as Splunk, to manage alerts, monitor for potential threats, and respond effectively
- 2+ years of direct experience supporting FedRAMP, NIST 800-53, or similar government security compliance frameworks
- Hands-on experience with tools such as Nessus, Splunk, Burp Suite, FortiClient EMS, and AWS GovCloud is required
- Experience applying compliance frameworks to support product security efforts, such as ensuring adherence to security best practices during product development and integration, particularly in cloud-based and SaaS environments
- Practical experience performing vulnerability scanning, patch management, and incident response
- Experience working with security tools such as Nessus, Splunk, FortiClient EMS, and Burp Suite
- Basic understanding of regulatory and compliance frameworks related to product security compliance, such as GDPR, CCPA, and NIST, to ensure the organization meets necessary security standards
- Experience in security compliance frameworks, including NIST 800 53 Rev 5 and FedRAMP, to ensure adherence to regulatory requirements and security best practices
- Demonstrates strong analytical thinking to assess complex systems, identify risks, and interpret vulnerability data
- Maintains a high level of attention to detail when reviewing configurations, scan results, and documentation
- Possesses strong technical proficiency with security tools, AWS GovCloud, and enterprise IT infrastructure
- Applies effective problem-solving skills to resolve security incidents and compliance gaps
- Manages multiple concurrent security projects and meets critical deadlines
- Communicates technical information clearly to both technical and non-technical audiences
- Adapts quickly to changing threats, technologies, and regulatory requirements
- Collaborates effectively with cross-functional teams and external vendors
- Proactively identifies opportunities to improve security posture and operational efficiency
- Provides leadership and mentorship to junior engineers, supporting team growth and development
- This position is contingent upon satisfactory completion of a more extensive background check through the Federal Government as a Public Trust Position. Requirements include (subject to change), but are not limited to, active U.S. Citizenship or green card holder residing in the U.S. for a minimum of 3 consecutive years
- Bachelor's degree in cybersecurity, information technology, computer science, or a related field
- Equivalent practical experience will be considered
- Experience supporting FedRAMP, NIST 800-53, or other government compliance frameworks
- Industry certifications such as CISSP, CISM, CEH, Security+, or equivalent
- Familiarity with cloud security, preferably within AWS GovCloud or other regulated cloud environments
- Experience managing or supporting a Security Operations Center (SOC) or 24/7 security monitoring environment
- Demonstrated ability to work in cross-functional teams and lead technical initiatives
- Experience supporting or leading FedRAMP High environments or other high-impact government-authorized systems
- Experience with Plan of Action and Milestones (POAM) management and working with GRC teams
- Exposure to penetration testing and red team operations in cloud and hybrid environments
- Experience automating security tasks using scripting languages such as Python, PowerShell, or Bash
- Knowledge of ticketing and workflow systems like ManageEngine ServiceDesk Plus (MESD)
- Ability to contribute to policy and procedure development and documentation
- Strong written communication skills for reporting, analysis, and compliance documentation
- Previous mentorship or leadership experience within a security team
Benefits
- Annual performance bonus
- ESPP
- Enhanced time off packages
- Fully remote within the U.S.
Company Overview