This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Principal Security Engineer based in the United States.
As a Principal Security Engineer, you will provide advanced security engineering expertise to support the assessment, authorization, and continuous monitoring of cloud-based systems within the federal cybersecurity landscape. You will evaluate complex technology architectures, review security control implementations, and help ensure alignment with FedRAMP, NIST, and agency-specific requirements. Working closely with Cloud Service Providers (CSPs), government stakeholders, and technical teams, you will identify security gaps, assess risks, and recommend practical solutions. You will also lead technical discussions, guide vendors through compliance expectations, and deliver assessments that inform key security decisions. This fully remote opportunity is suited to an experienced security professional who can combine deep technical knowledge, sound judgment, and strong communication skills to strengthen the security and resilience of federal cloud environments.
Accountabilities
In this role, you will lead technical security reviews and provide engineering guidance throughout the FedRAMP authorization and continuous monitoring lifecycle. You will work with government stakeholders and Cloud Service Providers to assess architectures, validate compliance, and address security risks.
• Conduct detailed architecture and technical design reviews across the full technology stack of vendor solutions.
• Evaluate Cloud Service Provider authorization packages to validate secure architecture, alignment with FedRAMP and agency requirements, identify compliance gaps, and advise government stakeholders on overall risk posture.
• Lead architecture interviews with CSPs to verify that critical security controls are appropriately implemented throughout their systems.
• Prepare architecture briefing documents for government program managers and CISOs, summarizing compliance status, technical capabilities, and potential concerns.
• Review and provide detailed feedback on FedRAMP documentation, including System Security Plans, security policies and procedures, supplemental agency guidance, alternative implementation proposals, and risk acceptance documents.
• Work with CSPs to resolve documentation deficiencies and technical security gaps identified during assessments.
• Review post-audit assessment packages, including security assessment plans and reports, vulnerability scans, and penetration test results, and prepare briefings for government leadership.
• Provide security engineering support to agency FedRAMP leadership and contribute to ongoing program activities.
• Support continuous monitoring by reviewing annual submissions, assessing significant change proposals, and evaluating risk acceptance requests.
• Interpret FedRAMP and agency-specific requirements and advise vendors on technical expectations, compliance processes, and implementation approaches.
• Monitor changes to FedRAMP guidance, government cybersecurity directives, emerging technologies, and industry best practices, providing recommendations on their potential impact.
• Assess technologies proposed for use within CSP authorization boundaries and determine their security implications.
• Manage relationships with assigned contractor-owned or contractor-operated systems, ensuring compliance with agency security and privacy requirements.
• Support stakeholders with IT security activities and help ensure project milestones and deadlines are achieved.
• Verify that systems are operated, maintained, and decommissioned in accordance with documented security policies and procedures, including Assessment and Authorization (A&A) requirements.
• Research assigned systems and develop recommendations regarding their security architecture, configuration, and overall protection.
Requirements
The ideal candidate brings substantial hands-on security engineering and architecture experience, particularly within the FedRAMP ecosystem. You should be comfortable evaluating complex cloud environments, interpreting federal security standards, and leading discussions with both technical and non-technical stakeholders.
• At least five years of professional experience in IT security.
• A bachelor's degree in Computer Science, Information Systems, Mathematics, Engineering, or a related discipline, or an additional three years of relevant IT experience in place of the degree.
• Direct experience as a Security Engineer or System Architect analyzing FedRAMP Cloud Service Provider architectures and security control implementations, such as through a Third-Party Assessment Organization (3PAO) or a federal agency's FedRAMP program.
• At least four years of hands-on technical experience as a System Architect or Security Engineer.
• At least four years of experience supporting FedRAMP as an Engineer or Architect.
• An active industry-recognized security certification, such as Security+, CISSP, CISM, CISA, or an equivalent qualification.
• Demonstrated ability to review third-party security assessment reports and evaluate technical evidence.
• Strong knowledge of NIST policies and frameworks, security governance, security planning and architecture, FISMA compliance, the Risk Management Framework (RMF), incident analysis, and general security best practices.
• Confidence and experience leading technical meetings and architecture discussions with prospective vendors and established CSPs.
• Excellent written and verbal communication skills, with the ability to explain complex security concepts to senior managers, technical teams, and non-technical business stakeholders.
• Strong analytical, organizational, and advisory skills, with the ability to manage multiple priorities and support project delivery.
• Legal authorization to work in the United States.
• Ability to obtain and maintain a Public Trust clearance.
Benefits
Eligible full-time employees receive a comprehensive benefits package designed to support their health, financial security, and professional development.
• Fully remote work opportunity.
• Choice of medical plans, including an HSA option and a PPO plan, with company contributions.
• Dental and vision coverage for employees and their families.
• Company-paid life insurance, short-term disability, and long-term disability coverage.
• Optional supplemental life, accident, and critical illness insurance.
• 401(k) retirement plan with company matching.
• Paid time off that increases with years of service.
• Paid federal holidays.
• Paid industry certifications and professional development opportunities.
• Access to an internal training and development portal.
• Flexible spending accounts.
• Wellness and fitness program.
• Employee referral bonuses.
How Jobgether works:
We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.
We appreciate your interest and wish you the best!
Why Apply Through Jobgether?
Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.