Consultant, Technical FedRAMP Assessment

About Coalfire Coalfire is on a mission to make the world a safer place by solving our clients’ hardest cybersecurity challenges. We work at the cutting edge of technology to advise, assess, automate, and ultimately help companies navigate the ever-changing cybersecurity landscape. We are headquartered in Chicago, Illinois with offices across the U. S. and U. K. , and we support clients around the world. But that’s not who we are – that’s just what we do. We are thought leaders, consultants, and cybersecurity experts, but above all else, we are a team of passionate problem-solvers who are hungry to learn, grow, and make a difference.

We're looking for a technically strong, self-starter Consultant to join our FedRAMP Assessment team. This role is for someone who can open a configuration file, command output, log extract, scan report or network diagram and understand what it actually shows and who, when they encounter an unfamiliar product, service, or setting, independently researches the vendor documentation to determine what it means for the control being assessed. The Consultant will apply that technical depth to FedRAMP assessments and, with mentoring from senior assessors, develop into a FedRAMP Assessor. What You'll Do - Work collaboratively with a team of assessors on federal compliance assessments (e. g. , FedRAMP, NIST 800-171, FISMA) and assist with the planning of assessment for clients - Review technical artifacts at a detailed level – configuration files and exports, system and console settings, command-line output, logs, vulnerability scan results, firewall rulesets, and network/boundary/data flow diagrams – and determine whether they demonstrate the stated control implementation - Review infrastructure as code templates, CI/CD pipeline configurations, and deployment scripts to validate configuration management, change control, and enforcement of secure baselines - Use scripting to parse and analyze large artifact sets (e. g. , configuration exports, logs, inventories, and scan data) to support control testing - Independently research unfamiliar technologies, products, and configuration settings using vendor documentation, knowledge bases, and hardening guides to determine what a setting does, what the secure configuration is, and how it relates to the control requirement - Analyze how network traffic flows and how common services (e. g.