Cloud Security Engineer, Senior

TIAG; Chevy Chase (MD); Hybrid; USD 140,000 - 190,000; Full time

Job summary

TIAG is seeking a Senior Cloud Security Engineer to advance the modernization of ATO packages for Google Cloud, Google Workspace, and ServiceNow GCC-High. The role involves assessing security controls to Rev 5 and IL-4, preparing RMF artifacts, and delivering gap analysis reports at USUHS in Bethesda, MD.

The position requires an active DoD Secret clearance, IAT III or IASAE II/III, and advanced cloud security certifications. Hybrid work at a government site is offered.

Qualifications

• Active DoD Secret clearance required.
• IAT Level III or IASAE Level II/III certification required.
• Advanced cloud security or architecture certification required.

Responsibilities

• Conduct technical discovery evaluating Google Cloud, Google Workspace, and ServiceNow GCC-High against Rev5 and IL-4.
• Analyze current implementations to identify gaps vs legacy baselines and agency configurations.
• Evaluate CSP FedRAMP packages to identify inherited vs agency-implemented controls.
• Validate assumptions through access reviews, configuration docs, and interviews with Government personnel.
• Identify cloud security control gaps, document risks, and provide remediation dispositions.
• Collect and validate evidence (screenshots, reports, logs) to support control implementations.
• Provide RMF narrative input reflecting cloud architecture rather than generic baselines.
• Perform HitL validation on AI-assisted content to ensure Rev5 and IL-4 alignment.
• Deliver DoD IL-4 Gap Analysis Report for Google environments and ServiceNow GCC-High alignment report.

Skills

Cloud security engineering

Cybersecurity architecture

RMF artifacts

NIST 800-53 Rev5

FedRAMP

HitL validation

Cloud platform expertise

Google Cloud

ServiceNow GCC-High

Technical interviews

Education

DoD 8140/8570 IAT Level III or IASAE Level II/III

Advanced cloud security certification

CISSP / CASP+ / CSSLP / CCSP

GCP Professional Security Engineer

DoD security certification knowledge

Job description

TIAG is seeking a Senior Cloud Security Engineer to drive the technical discovery, gap analysis, and security architecture validation for the modernization of Authorization to Operate (ATO) packages. This role focuses specifically on evaluating and securing Google Cloud, Google Workspace, and ServiceNow GCC-High instances, transitioning them from legacy NIST SP 800-53 Revision 3 baselines to NIST SP 800-53 Revision 5 and DoD Impact Level 4 (IL-4) standards.This position reports to our customer site at the Uniformed Services University of Heath Sciences (USUHS) in Bethesda, MD in a hybrid capacity. A secret clearance is required to start work, so US or Naturalized Citizenship is a requirement.Key ResponsibilitiesConduct technical discovery by evaluating Google Cloud, Google Workspace, and ServiceNow GCC-High environments against NIST SP 800-53 Revision 5 and DoD Cloud Computing Security Requirements Guide IL-4 requirements.Analyze existing technical implementations to identify differences between legacy control documentation, DISA eMASS baseline assumptions, and the Agency's actual cloud configuration.Evaluate Cloud Service Provider (CSP) FedRAMP security packages provided by Google and ServiceNow to accurately identify inherited controls versus shared or Agency-implemented responsibilities.Validate technical assumptions through system access, review of available technical configuration documentation, and technical interviews with Government personnel.Identify cloud security control gaps, document the associated risks, and provide recommended dispositions for future remediation without altering production configurations.Collect, review, and validate technical evidence—such as configuration screenshots, system-generated reports, and log exports—necessary to support the documented control implementation.Provide technical engineering input for RMF artifacts, ensuring implementation-specific control narratives accurately reflect the cloud architecture rather than generic baseline statements.Conduct Human-in-the-Loop (HitL) validation on AI-assisted technical content to ensure architectural and configuration statements are highly accurate and properly address Rev 5 and IL-4 requirements.Deliver key technical reports, including the DoD IL-4 Gap Analysis Report for Google environments and the ServiceNow GCC-High Technical Alignment Report.Required Experience:Active DoD Secret clearance required.DoD 8140/8570 IAT Level III or IASAE Level II/III certification required (e.g., CISSP, CASP+ CE, CSSLP).An advanced cloud security or architecture certification is required (e.g., Google Cloud Professional Security Engineer, Certified Cloud Security Professional (CCSP), or Google Cloud Professional Cloud Architect).8+ years of relevant cloud security engineering and cybersecurity architecture experience, with a strong background in securing enterprise cloud environments.Ability to work cross-functionally, complementing the efforts of the Cyber Security Analyst, Senior ISSE, and Senior ServiceNow GRC Specialist to deliver cohesive authorization packages.Deep technical understanding of Google Cloud, Google Workspace, and ServiceNow GCC-High platform architectures and native security capabilities.Advanced expertise in applying NIST SP 800-53 Revision 5 controls, DoD IL-4 parameters, and FedRAMP inheritance models to complex cloud environments.Demonstrated ability to translate complex technical cloud configurations into clear, compliant control narratives and RMF evidence.TIAG is an equal opportunity employer and federal contractor or subcontractor. Consequently, the parties agree that, as applicable, they will abide by the requirements of 41 CFR 60-1.4(a), 41 CFR 60-300.5(a), and 41 CFR 60-741.5(a) and employment decisions shall be based solely on merit and without regard disability, or protected veteran status, or any other characteristic protected by local, state, or federal laws, rules, or regulations. TIAG takes proactive steps to employ and advance in employment qualified individuals without regard to disability or protected veteran status. The parties also agree that, as applicable, they will abide by the requirements and may be subject and required to take action pursuant to the following laws and accompanying regulations:The Vietnam Era Veterans Readjustment Assistance Act of 1974, as amended (and its implementing regulations at 41 C.F.R. 60-300);Section 503 of the Rehabilitation Act of 1973, as amended (and its implementing regulations at 41 C.F.R 60-741); andExecutive Order 13496 (and its implementing regulations at 29 C.F.R. part 471, Appendix A to Subpart A).