Sr. Information Security Engineer, FedRAMP

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Sr. Information Security Engineer, FedRAMP based in the United States. This is a senior security engineering opportunity for a professional passionate about protecting cloud environments and maintaining rigorous government security standards. In this fully remote role, you will help maintain FedRAMP High compliance and strengthen the security posture of regulated cloud services. You will lead security operations initiatives, oversee vulnerability management and remediation, and support compliance with NIST SP 800-53 Revision 5. Working across security operations, cloud infrastructure, and governance, risk, and compliance (GRC), you will help ensure systems remain secure, resilient, and audit-ready. Your responsibilities will span AWS GovCloud security, incident response, disaster recovery, endpoint protection, access management, and continuous monitoring. You will also contribute to security assessments, process automation, technical documentation, and the development of fellow engineers. This role offers the opportunity to make a meaningful impact on the protection of sensitive information in a highly regulated technology environment. Accountabilities - Lead project management and operational oversight for FedRAMP security operations services, maintaining alignment with applicable security requirements and service-level agreements. - Support annual FedRAMP Third-Party Assessment Organization (3PAO) assessments, security control validation, annual assessment preparation, and significant change management reviews. - Manage operating system patching across a fleet of up to 350 servers, tracking remediation activities and maintaining secure configurations. - Administer endpoint protection solutions, including FortiClient EMS, and oversee AWS backup and disaster recovery operations using N2WS Backup.

- Conduct monthly vulnerability assessments across operating systems, databases, containers, web applications, and STIG baselines using tools such as Nessus and Burp Suite. Analyze results, produce reports, and perform rescans to verify remediation. - Operate and maintain SIEM capabilities, including Splunk, to support threat detection, event correlation, continuous log monitoring, and intrusion detection. - Maintain security operations coverage, including SOC response service-level agreements and a technical support callback target of 15 minutes. - Conduct continuous monitoring and FedRAMP validation scans, configuration consistency checks, and quarterly authorized software reviews. - Assess AWS GovCloud security configurations, including security groups, access control lists, and access permissions. - Administer Active Directory accounts, including account creation, password resets, and YubiKey setup, while managing user access to production, pre-production, and security systems. - Support annual penetration testing and red team exercises, validating findings and coordinating remediation activities. - Collaborate with the GRC team to assess and resolve Security Impact Analyses (SIAs), Significant Change Requests (SCRs), and Plans of Action and Milestones (POAMs). - Develop, test, and maintain incident response and disaster recovery plans in accordance with NIST SP 800-53 Revision 5. - Contribute to security policy and procedure updates, technical runbooks, knowledge base articles, and process documentation. - Support broader security audits and compliance programs, including SOC 2, HITRUST, and PCI, as well as vendor risk assessments and third-party security reviews. - Participate in cross-functional infrastructure and application projects, evaluating security tools, conducting proof-of-concept testing, and identifying opportunities for automation and operational improvement.