Sr. Information Security Engineer, FedRAMP

Jobgether; United States; Remote; USD 180,000 - 190,000; Full time

Benefits offered by this job

Annual bonus

ESPP

Enhanced PTO

Fully remote

Full-time employment

Job summary

Jobgether, on behalf of a partner company, seeks a Sr. Information Security Engineer focused on FedRAMP High in the United States. This fully remote role supports government security standards and cloud environments, leading security operations and vulnerability management.

You will oversee SIEM (Splunk), IAM, AWS GovCloud, 3PAO coordination, and incident response, while guiding engineers and contributing to policy, audits, and continuous monitoring in alignment with NIST SP 800-53 Revision 5.

Qualifications

• Bachelor's degree in cybersecurity, information technology, computer science, or related field.
• 5+ years of cybersecurity experience including security engineering.
• 5+ years with vulnerability management tools (Nessus Pro, Burp Suite, SonarQube).
• 5+ years with endpoint protection platforms (FortiClient EMS, CrowdStrike, Carbon Black, or SentinelOne).
• 5+ years with cloud providers and CSPM tools (AWS Security Hub).
• 4+ years of hands-on AWS security services (IAM, CloudTrail, GuardDuty, Security Hub).
• 4+ years implementing STIGs and baseline configurations.
• 4+ years with AWS backup/disaster recovery tools (N2WS).
• 4+ years with Okta or similar auth systems.
• 4+ years with SIEM (Splunk, Elastic, Exabeam).
• 2+ years supporting FedRAMP, NIST SP 800-53, or similar gov frameworks.

Responsibilities

• Lead FedRAMP security operations services and SLA alignment.
• Support 3PAO assessments, security control validation, and major change reviews.
• Manage OS patching across up to 350 servers and secure configurations.
• Administer endpoint protection and AWS backup/disaster recovery operations.
• Conduct monthly vulnerability assessments of OS, DBs, containers, apps and STIGs; report findings.
• Operate and maintain SIEM capabilities (Splunk) for threat detection and monitoring.
• Maintain SOC coverage and quick security support callbacks (15 minutes).
• Coordinate FedRAMP validation scans and quarterly software reviews.
• Assess AWS GovCloud security configurations, access controls, and permissions.
• Administer Active Directory accounts including YubiKey setup and access control.
• Support annual pen tests and red team exercises; coordinate remediations.
• Collaborate with GRC on SIAs, SCRs, and POAMs.
• Develop and test incident response and DR plans per NIST 800-53 Rev 5.
• Contribute to security policy, runbooks, and process docs.
• Support SOC 2, HITRUST, PCI audits and third-party risk reviews.
• Participate in security tool evaluations and automation opportunities.
• Address privacy incidents involving PII/PHI.
• Research threats and provide security awareness training as needed.
• Mentor engineers and provide team backups.

Skills

FedRAMP

Vulnerability management

NIST SP 800-53

AWS GovCloud

SIEM Splunk

Endpoint protection

Incident response

Patching & hardening

Okta

3PAO coordination

Leadership

Education

Bachelor's degree in cybersecurity or related field

Tools

Nessus

Burp Suite

FortiClient EMS

Splunk

N2WS Backup

Okta

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Sr. Information Security Engineer, FedRAMP based in the United States.

This is a senior security engineering opportunity for a professional passionate about protecting cloud environments and maintaining rigorous government security standards.

In this fully remote role, you will help maintain FedRAMP High compliance and strengthen the security posture of regulated cloud services.

You will lead security operations initiatives, oversee vulnerability management and remediation, and support compliance with NIST SP 800-53 Revision 5.

Working across security operations, cloud infrastructure, and governance, risk, and compliance (GRC), you will help ensure systems remain secure, resilient, and audit-ready.

Your responsibilities will span AWS GovCloud security, incident response, disaster recovery, endpoint protection, access management, and continuous monitoring.

You will also contribute to security assessments, process automation, technical documentation, and the development of fellow engineers.

This role offers the opportunity to make a meaningful impact on the protection of sensitive information in a highly regulated technology environment.

Accountabilities

• Lead project management and operational oversight for FedRAMP security operations services, maintaining alignment with applicable security requirements and service-level agreements.
• Support annual FedRAMP Third-Party Assessment Organization (3PAO) assessments, security control validation, annual assessment preparation, and significant change management reviews.
• Manage operating system patching across a fleet of up to 350 servers, tracking remediation activities and maintaining secure configurations.
• Administer endpoint protection solutions, including FortiClient EMS, and oversee AWS backup and disaster recovery operations using N2WS Backup.
• Conduct monthly vulnerability assessments across operating systems, databases, containers, web applications, and STIG baselines using tools such as Nessus and Burp Suite. Analyze results, produce reports, and perform rescans to verify remediation.
• Operate and maintain SIEM capabilities, including Splunk, to support threat detection, event correlation, continuous log monitoring, and intrusion detection.
• Maintain security operations coverage, including SOC response service-level agreements and a technical support callback target of 15 minutes.
• Conduct continuous monitoring and FedRAMP validation scans, configuration consistency checks, and quarterly authorized software reviews.
• Assess AWS GovCloud security configurations, including security groups, access control lists, and access permissions.
• Administer Active Directory accounts, including account creation, password resets, and YubiKey setup, while managing user access to production, pre-production, and security systems.
• Support annual penetration testing and red team exercises, validating findings and coordinating remediation activities.
• Collaborate with the GRC team to assess and resolve Security Impact Analyses (SIAs), Significant Change Requests (SCRs), and Plans of Action and Milestones (POAMs).
• Develop, test, and maintain incident response and disaster recovery plans in accordance with NIST SP 800-53 Revision 5.
• Contribute to security policy and procedure updates, technical runbooks, knowledge base articles, and process documentation.
• Support broader security audits and compliance programs, including SOC 2, HITRUST, and PCI, as well as vendor risk assessments and third‑party security reviews.
• Participate in cross‑functional infrastructure and application projects, evaluating security tools, conducting proof‑of‑concept testing, and identifying opportunities for automation and operational improvement.
• Help address privacy incidents and data breaches involving personally identifiable information (PII) or protected health information (PHI).
• Research emerging threats, vulnerabilities, and security trends; provide security awareness training when needed; and participate in relevant industry or government security forums.
• Mentor other security engineers, provide backup support across the team, and perform additional duties as business needs require.

Requirements

• A bachelor's degree in cybersecurity, information technology, computer science, or a related field is preferred; equivalent practical experience may be considered.
• At least five years of cybersecurity experience, including five or more years in security engineering or a similar technical security role.
• At least five years of experience with vulnerability management tools used to identify, track, and remediate security weaknesses across systems and applications, such as Nessus Pro, Burp Suite, or SonarQube.
• At least five years of experience with endpoint protection platforms such as FortiClient EMS, CrowdStrike, Carbon Black, or SentinelOne.
• At least five years of experience with cloud service providers and security platforms, including cloud‑native application protection and cloud security posture management tools such as AWS Security Hub.
• Four or more years of hands‑on experience with AWS security services, including IAM, CloudTrail, GuardDuty, and Security Hub.
• Four or more years of experience implementing Security Technical Implementation Guides (STIGs) and baseline configuration management.
• Four or more years of experience with AWS backup and disaster recovery tools, such as N2WS Backup.
• Four or more years of experience with one‑time password and secure authentication systems, such as Okta.
• Four or more years of experience using SIEM platforms such as Splunk, Elastic, or Exabeam, alongside security monitoring and incident response processes.
• At least two years of direct experience supporting FedRAMP, NIST SP 800-53, or comparable government security compliance frameworks. Experience with FedRAMP High environments is strongly preferred.
• Required hands‑on proficiency with tools such as Nessus, Splunk, Burp Suite, FortiClient EMS, and AWS GovCloud.
• Experience conducting vulnerability scans, managing patches, responding to security incidents, and applying compliance controls in cloud-based or SaaS environments.
• Familiarity with product security and related regulatory frameworks, including NIST requirements, GDPR, and CCPA.
• Experience supporting a Security Operations Center or a 24/7 security monitoring environment is an advantage.
• Industry certifications such as CISSP, CISM, CEH, Security+, or equivalent are preferred but not required.
• Strong analytical and problem‑solving skills, with careful attention to detail when evaluating system configurations, vulnerability results, and compliance documentation.
• Demonstrated ability to lead technical initiatives, manage multiple projects and deadlines, and adapt to changing threats, technologies, and regulatory requirements.
• Excellent written and verbal communication skills, including the ability to explain technical security matters to both technical and non‑technical audiences.
• Strong collaboration skills when working with internal teams, external vendors, and compliance stakeholders, together with a proactive approach to improving security and operational efficiency.
• A commitment to ongoing cybersecurity training and continuing professional development.

Additional Qualifications That Would Be An Advantage

• Experience supporting or leading FedRAMP High environments or other high‑impact government‑authorized systems.
• Experience managing POAMs and collaborating with GRC teams on compliance remediation.
• Exposure to penetration testing and red team operations in cloud or hybrid environments.
• Scripting and automation experience using Python, PowerShell, or Bash.
• Familiarity with ticketing and workflow platforms such as ManageEngine ServiceDesk Plus.
• Experience developing security policies, procedures, and compliance documentation.
• Previous experience mentoring engineers or providing technical leadership within a security team.

Benefits

• Annual base salary: $180,000–$190,000 USD.
• Potential annual performance bonus, depending on the compensation package.
• Employee Stock Purchase Plan (ESPP).
• Enhanced paid time‑off packages.
• Additional employee benefits as part of the total compensation package.
• Fully remote work within the United States.
• Full‑time employment opportunity.
• Opportunity to contribute to security initiatives that protect sensitive data and support highly regulated cloud services.

How Jobgether Works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top‑fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre‑contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.