Security Engineer

TechDigital Group; Secaucus (NJ); On-site; USD 150,000 - 200,000; Full time

Job summary

TechDigital Group is seeking a Lead Security Engineer to drive end-to-end engineering and automation for FedRAMP KSIs in a Google Cloud environment.

You will bridge regulatory compliance with hands-on cloud engineering, designing automated controls, and guiding a technical team to implement secure architectures across GCP.

Qualifications

• 7+ years of experience in Cloud Security/DevSecOps or Infra Security, with lead/senior-level responsibilities.
• Hands-on GCP expertise: CAI, SCC, IAM, Cloud Audit Logs, Cloud Storage.
• Advanced CEL proficiency; working knowledge of Python/Go/OPA languages.
• Experience configuring and automating vulnerability and container scanning tools at scale.
• Experience with Google Cloud infrastructure and container orchestration (Kubernetes/GKE/Borg).
• Familiarity with automated control evaluation for NIST SP 800-53 Rev 5, CIS Benchmarks, FedRAMP Conmon.
• Bachelor's or Master's degree in CS/IT/Cybersecurity or equivalent practical experience.

Responsibilities

• Lead discovery workshops to translate FedRAMP KSIs into automatable technical specs.
• Oversee VM vulnerability pipelines and container image scanning across cloud assets.
• Develop and test CEL evaluation rules to define precise Pass/Fail criteria for controls.
• Design telemetry architecture with log agents and Cloud Logging sinks for full coverage.
• Architect least-privilege IAM bindings, service accounts, and VPC Service Controls.
• Support deployments with version control and progressive rollout strategies.
• Collaborate with Governance teams and 3PAO assessors to provide engineering evidence.

Skills

Leadership

Cloud Security

DevSecOps

Communication

Education

Bachelor's or Master's in CS/IT/Cybersecurity

Tools

CEL (Common Expression Language)

Python

Go

Rego/OPA

Kubernetes

Job description

Role Overview

The Lead Security Engineer is the primary technical lead responsible for the end-to-end engineering and automation of the FedRAMP Key Security Indicator (KSI) initiative. This role bridges the gap between regulatory compliance and hands-on cloud engineering. The Lead Engineer will design automated cloud controls, manage GCP security vulnerability pipelines, and guide a technical team in deploying solutions that ensure continuous monitoring and secure architectures across Google Cloud Platform (GCP).

Key Responsibilities

• Technical Leadership & Translation: Lead discovery workshops to deconstruct FedRAMP KSIs and NIST SP 800-53 controls, translating high-level compliance mandates into binary, automatable technical specifications.
• Vulnerability Management & Pipelines: Oversee and implement VM vulnerability scanning (AutoVM, Tenable, Qualys, Nessus), container image scanning (Artifact Registry / Drydock), and static/dynamic analysis tools.
• Automation & Scripting: Analyze Google Cloud Asset Inventory (CAI) schemas and oversee the authoring and testing of Common Expression Language (CEL) evaluation rules to define precise Pass/Fail criteria for cloud controls.
• Pipeline & Telemetry Architecture: Design, deploy, and troubleshoot log agents (Fluentbit/Vector) and Cloud Logging sinks to ensure 100% telemetry coverage across container nodes, VMs, and control-plane APIs.
• Identity & Access Management (IAM): Architect and enforce least-privilege IAM bindings, service accounts, and VPC Service Controls across the GCP environment.
• Validation & Deployment: Test logic against synthetic resources in sandbox environments to minimize false positives, manage codebase version control (Git/Piper), and support progressive deployment rollouts.
• Cross-Functional Collaboration: Act as the technical bridge for the project, supporting gap analyses and providing engineering evidence to Governance teams and 3PAO assessors.

Qualifications & Requirements

• Experience: 7+ years in Cloud Security Engineering, DevSecOps, or Infrastructure Security, with proven experience as a Lead/Senior Engineer managing FedRAMP (Moderate/High) security vulnerability implementations.
• Cloud Platform Expertise: Strong, hands-on background in Google Cloud Platform (GCP), specifically with Cloud Asset Inventory (CAI), Security Command Center (SCC), IAM, Cloud Audit Logs, and Cloud Storage.
• Scripting & Languages: Advanced proficiency in Common Expression Language (CEL). Working knowledge of Python, Go, or Rego/OPA.
• Vulnerability Tooling: Practical experience configuring and automating vulnerability and container scanning tools in a large-scale cloud environment.
• Systems & Infrastructure: Experience with Google Cloud infrastructure and container orchestration (Kubernetes/GKE/Borg).
• Compliance Knowledge: Strong familiarity with automated control evaluation for NIST SP 800-53 Rev 5, CIS Benchmarks, and FedRAMP Continuous Monitoring (ConMon).
• Education: Bachelor's or Master's degree in Computer Science, Information Technology, Cybersecurity, or equivalent practical experience.