Remote Cloud Security Architect | RMF & FedRAMP Expert

Northramp LLC.; Bethesda (MD); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Employee Bonus Programs

Medical, Dental, and Vision Insurance

401(k) Retirement Plan

Basic Life, Voluntary Life, and AD&D

Short-Term and Long-Term Disability

Paid Time Off

Paid Parental Leave

Training and Professional Development

Remote Work Opportunities

Wellness Resources

Job summary

Northramp LLC. is seeking a Cloud Security Architect to support the CISO and oversee ATO processes for a centralized HHS client program across AWS, GCP, and Azure. You will craft SSPs, SARs, and POA&Ms, and guide risk decisions with federal- level controls and continuous monitoring.

You will work with CISOs, ISSOs, assessors, and engineers, aligning packages to FISMA/NIST/SP baselines while building reusable security artifacts and guardrails for multi-cloud environments.

Qualifications

• Bachelor's degree in information security, computer science, or a related field, or equivalent experience.
• 6 years of information security experience, including 3 years on federal ATO packages under the NIST RMF.
• Authored SSPs, SARs, and POA&Ms that an Authorizing Official accepted.
• Working knowledge of the NIST SP 800-53 Rev. 5 control families and of common and inherited controls.
• Hands-on security architecture experience in at least one of AWS, GCP, or Azure in federal environments, and working knowledge of the other two: account, subscription, and project structure, identity, network, encryption, and logging.
• Experience with FedRAMP authorized services, FedRAMP baselines, and customer responsibility matrices.
• Experience running threat models and architecture reviews with engineers.
• Written and spoken communication with CISOs, Authorizing Officials, assessors, and engineers.
• One of the following certifications: CISSP, CCSP, or CISM.
• Eligible to work in the United States.

Responsibilities

• Manages the ATO process for the broker's authorization boundaries and for each customer environment onboarded to it: categorization under FIPS 199, control selection and tailoring, implementation, assessment, authorization, and continuous monitoring.
• Prepares and tracks System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and authorization decision packages.
• Keeps one schedule and one status report for every environment in the authorization process.
• Directs continuous monitoring: annual assessments, significant change reviews, POA&M closure, and vulnerability and configuration findings.
• Briefs the CISO and Authorizing Officials on authorization status, open risks, and risk acceptance requests.
• Aligns packages to the Federal Information Security Modernization Act (FISMA), NIST SP 800-37 Rev. 2, NIST SP 800-53 Rev. 5, NIST SP 800-53A, FIPS 199 and 200, and the Federal Risk and Authorization Management Program (FedRAMP) baselines.
• Coordinates assessors, ISSOs, system owners, and engineers on evidence and schedule.
• Defines and maintains the catalog of controls that customer environments inherit from the broker's boundary, landing zones, and shared services in AWS, GCP, and Azure.
• Maintains customer responsibility matrices for each cloud service provider and service, tied to the provider's current FedRAMP authorization and to the federal regions it offers, such as AWS GovCloud (US), Azure Government, and Google Cloud Assured Workloads.
• Builds reusable SSP sections, control narratives, and evidence templates so that a customer environment documents only the controls it implements itself.
• Reviews each onboarding request to confirm which controls the environment inherits and which it owns.
• Reports the share of controls inherited per environment and the time from onboarding request to authorization decision.
• Reviews each new service before deployment: data flows, authorization boundary, identity and access, network segmentation, encryption with FIPS 140 validated modules, logging, and vulnerability management.
• Writes a security architecture decision for each new service that lists the required controls, the inherited controls, and the residual risk, before the build starts.
• Writes reference architectures and guardrails for accounts, subscriptions, projects, landing zones, and policy as code in AWS, Azure, and GCP.
• Determines whether a new service fits inside the authorized boundary or requires a significant change review.
• Checks the FedRAMP status of each cloud service before it enters the broker's service catalog.
• Sits on the architecture and change review boards.

Skills

Security architecture

Threat modeling

Communication with CISOs

FedRAMP familiarity

NIST RMF

NIST 800-53 Rev.5

Education

Bachelor's degree in information security, computer science, or a related field

Tools

ServiceNow

Splunk

OSCAL

Terraform

Job description

Northramp LLC. is seeking a Cloud Security Architect to support the CISO and oversee ATO processes for a centralized HHS client program across AWS, GCP, and Azure. You will craft SSPs, SARs, and POA&Ms, and guide risk decisions with federal- level controls and continuous monitoring.

You will work with CISOs, ISSOs, assessors, and engineers, aligning packages to FISMA/NIST/SP baselines while building reusable security artifacts and guardrails for multi-cloud environments.