Remote Cloud Security Architect (RMF/ATO)

Northramp, LLC; Bethesda (MD); Hybrid; USD 150,000 - 190,000; Full time

Benefits offered by this job

Employee Bonus Programs

Medical, Dental, and Vision Insurance

401(k) Retirement Plan

Paid Time Off

Remote Work Opportunities

Wellness Resources

Job summary

Northramp, LLC is seeking a Cloud Security Architect to support the CISO in a centralized services contract for an HHS client. You will manage the RMF ATO process across AWS, GCP, and Azure, maintain inherited controls, and review security architectures before deployment.

You will collaborate with CISOs, Authorizing Officials, ISSOs, assessors, cloud engineers, and customer leads to implement security controls, develop SSPs/SARs/POA&Ms, and ensure continuous monitoring and risk acceptance

Qualifications

• Bachelor's degree in information security, computer science, or a related field, or equivalent experience.
• 6 years of information security experience, including 3 years on federal ATO packages under the NIST RMF.
• Authored SSPs, SARs, and POA&Ms that an Authorizing Official accepted.
• Working knowledge of the NIST SP 800-53 Rev. 5 control families and of common and inherited controls.
• Hands-on security architecture experience in at least one of AWS, GCP, or Azure in federal environments, and working knowledge of the other two: account, subscription, and project structure, identity, network, encryption, and logging.
• Experience with FedRAMP authorized services, FedRAMP baselines, and customer responsibility matrices.
• Experience running threat models and architecture reviews with engineers.
• Written and spoken communication with CISOs, Authorizing Officials, assessors, and engineers.
• Certifications: CISSP, CCSP, or CISM.
• Eligible to work in the United States.

Responsibilities

• Manages the ATO process for the broker's authorization boundaries and for each customer environment onboarded to it.
• Prepares and tracks SSPs, SARs, POA&Ms, and authorization decision packages.
• Keeps one schedule and one status report for every environment in the authorization process.
• Directs continuous monitoring: annual assessments, significant change reviews, POA&M closure, and vulnerability and configuration findings.
• Briefs the CISO and Authorizing Officials on authorization status, open risks, and risk acceptance requests.
• Aligns packages to FISMA, NIST SP 800-37 Rev. 2, NIST SP 800-53 Rev. 5, NIST SP 800-53A, FIPS 199 and 200, and FedRAMP baselines.
• Coordinates assessors, ISSOs, system owners, and engineers on evidence and schedule.
• Defines and maintains the catalog of controls that customer environments inherit from the broker's boundary.
• Maintains customer responsibility matrices for each cloud service provider and service.
• Builds reusable SSP sections, control narratives, and evidence templates.
• Reviews onboarding requests to confirm control ownership and inheritance.
• Reports the share of controls inherited per environment and the time from onboarding request to authorization decision.
• Reviews each new service before deployment: data flows, authorization boundary, IAM, network segmentation, encryption with FIPS 140 validated modules, logging, and vulnerability management.
• Writes a security architecture decision for each new service listing required controls, inherited controls, and residual risk.

Skills

Security architecture

Threat modeling

Communication (written & verbal)

RMF/NIST knowledge

FedRAMP experience

Education

Bachelor's degree in information security or related field

Tools

AWS

GCP

Azure

Terraform

ServiceNow

Splunk

OSCAL

Job description

Northramp, LLC is seeking a Cloud Security Architect to support the CISO in a centralized services contract for an HHS client. You will manage the RMF ATO process across AWS, GCP, and Azure, maintain inherited controls, and review security architectures before deployment.

You will collaborate with CISOs, Authorizing Officials, ISSOs, assessors, cloud engineers, and customer leads to implement security controls, develop SSPs/SARs/POA&Ms, and ensure continuous monitoring and risk acceptance