The Cloud Security Architect supports the Chief Information Security Officer (CISO) for a centralized services contract supporting an HHS client. The cloud broker has more than 1,000 customer environments in Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. The Architect manages the Authorization to Operate (ATO) process under the NIST Risk Management Framework (RMF), maintains the controls that customer environments inherit from the broker, and reviews the security architecture of each new service before it is deployed.
The Architect works with the CISO, Authorizing Officials, system owners, Information System Security Officers (ISSOs), assessors, cloud engineers, and customer technical leads.
Responsibilities
CISO Support and ATO Management (RMF)
- Manages the ATO process for the broker's authorization boundaries and for each customer environment onboarded to it: categorization under FIPS 199, control selection and tailoring, implementation, assessment, authorization, and continuous monitoring.
- Prepares and tracks System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and authorization decision packages.
- Keeps one schedule and one status report for every environment in the authorization process.
- Directs continuous monitoring: annual assessments, significant change reviews, POA&M closure, and vulnerability and configuration findings.
- Briefs the CISO and Authorizing Officials on authorization status, open risks, and risk acceptance requests.
- Aligns packages to the Federal Information Security Modernization Act (FISMA), NIST SP 800-37 Rev. 2, NIST SP 800-53 Rev. 5, NIST SP 800-53A, FIPS 199 and 200, and the Federal Risk and Authorization Management Program (FedRAMP) baselines.
- Coordinates assessors, ISSOs, system owners, and engineers on evidence and schedule.
Inheritability
- Defines and maintains the catalog of controls that customer environments inherit from the broker's boundary, landing zones, and shared services in AWS, GCP, and Azure.
- Maintains customer responsibility matrices for each cloud service provider and service, tied to the provider's current FedRAMP authorization and to the federal regions it offers, such as AWS GovCloud (US), Azure Government, and Google Cloud Assured Workloads.
- Builds reusable SSP sections, control narratives, and evidence templates so that a customer environment documents only the controls it implements itself.
- Reviews each onboarding request to confirm which controls the environment inherits and which it owns.
- Reports the share of controls inherited per environment and the time from onboarding request to authorization decision.
Security Architecture Input Before Deployment
- Reviews each new service before deployment: data flows, authorization boundary, identity and access, network segmentation, encryption with FIPS 140 validated modules, logging, and vulnerability management.
- Works with customer technical leads and cloud engineers during onboarding to select the cloud service provider and product stack that meet the customer's requirements and the security controls.
- Writes a security architecture decision for each new service that lists the required controls, the inherited controls, and the residual risk, before the build starts.
- Writes reference architectures and guardrails for accounts, subscriptions, projects, landing zones, and policy as code in AWS, Azure, and GCP.
- Determines whether a new service fits inside the authorized boundary or requires a significant change review.
- Checks the FedRAMP status of each cloud service before it enters the broker's service catalog.
- Sits on the architecture and change review boards.
Requirements
- Bachelor's degree in information security, computer science, or a related field, or equivalent experience.
- 6 years of information security experience, including 3 years on federal ATO packages under the NIST RMF.
- Authored SSPs, SARs, and POA&Ms that an Authorizing Official accepted.
- Working knowledge of the NIST SP 800-53 Rev. 5 control families and of common and inherited controls.
- Hands-on security architecture experience in at least one of AWS, GCP, or Azure in federal environments, and working knowledge of the other two: account, subscription, and project structure, identity, network, encryption, and logging.
- Experience with FedRAMP authorized services, FedRAMP baselines, and customer responsibility matrices.
- Experience running threat models and architecture reviews with engineers.
- Written and spoken communication with CISOs, Authorizing Officials, assessors, and engineers.
- One of the following certifications: Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), or Certified Information Security Manager (CISM).
- Eligible to work in the United States.
Preferred Qualifications
- Experience supporting a multi-tenant cloud environment with hundreds of accounts and many customers.
- Experience building inherited control catalogs, reusable authorization packages, or automated control evidence, including Open Security Controls Assessment Language (OSCAL).
- Experience with governance, risk, and compliance (GRC) tools, ServiceNow, and Splunk for control evidence and monitoring.
- Experience writing policy as code and infrastructure as code guardrails, for example with Terraform.
- Experience moving a system boundary from FISMA Moderate to High.
- Certifications: Certified Authorization Professional (CAP), Information Systems Security Engineering Professional (ISSEP), Certified Information Systems Auditor (CISA), AWS Certified Security Specialty, Microsoft Certified Cybersecurity Architect Expert, or Google Professional Cloud Security Engineer.
Benefits
- Employee Bonus Programs
- Medical, Dental, and Vision Insurance
- 401(k) Retirement Plan
- Basic Life, Voluntary Life, and AD&D Insurance
- Short-Term and Long-Term Disability Insurance
- Paid Time Off
- Paid Parental Leave
- Training and Professional Development
- Remote Work Opportunities
- Wellness Resources