FedRAMP Senior Cyber Engineer - Noblis

Responsibilities

*** This position is for future upcoming work***

Are you a Cloud Computing and Cyber Security professional? Are you looking to make an impact across the entire federal government? Do you have NIST Risk Management Framework (RMF) knowledge andexperience? Do you love researching new technologies and capabilities? Are you self-driven and detailoriented with excellent written and verbal skills? Then this job is for you. Come be a part of a rapidly growing team of highly skilled FedRAMP cyber security SMEs and help redefine the FedRAMP process.

FedRAMP Cyber Security Engineers are FISMA, NIST RMF and FedRAMP subject matter experts. We review security packages to evaluate compliance with FedRAMP security requirements and ensure package deliverables clearly and accurately represent the security and risk posture of the cloud service offering. FedRAMP Cyber Security Engineers review the system architecture, authorization boundary, data flows, security controls, and the results of an independent security assessment to determine suitability for government-wide use. Cyber Security Engineers work with the FedRAMP team to advise on new and emerging technologies with an emphasis on security impact. We are seeking qualified individuals to be FedRAMP SMEs and develop government-wide guidance.

Key Responsibilitiesa:

• Perform compliance reviews of cloud service offering (CSO) system security plans (SSPs) to ensure the security posture is sufficient for multi-agency USG use
• Provide risk-based guidance to cloud service providers (CSPs) to address areas found to be non-compliant
• This position focuses on the architecture portion of the SSP, and requires the successful candidate to:
  • Interpret multiple graphic representations of a CSO detailing aspects such as the boundary, encryption status, and subnet architecture
  • Compare implementation stated in SSP to other documents in the overall compliance package such as an auditor’s security assessment report (SAR), on an as needed basis
  • Clearly document review findings with guidance to CSPs for remediation in a templated report
  • Work hand-in-glove with a team of SMEs that are performing the same level of review on other portions of the compliance package
  • Operate in a high-visibility environment where your judgement will:
    • • Have significant impact on cybersecurity for the USG
      • Be scrutinized in detail, first by your colleagues within the program, and then by external stakeholders
      • Be completely supported by the program when finalized
• Organizationally, day-to-day activities require:
  • Maintaining focus on the highest priority package at hand
  • Rapidly shifting focus to support stakeholder review meetings to present your findings
  • Daily reporting of package status to coordinate multiple teams reviewing multiple packages
  • Contributing to, and following, detailed standard operating procedures to ensure:
    • Firm, fair, and consistent reviews from one package to the next
    • Secure handling of sensitive and proprietary vendor data
    • Coordination of document revision control with your team members
• Exceptional candidates will have experience in several of the following areas of compliance focus:
  • FIPS 140 validated encryption addressing data at rest, data in transit, and MFA authenticators
  • Human-to-machine authentication based on NIST SP 800-63-3
  • Familiarity with service offerings from hyperscale IaaS/PaaS vendors such as AWS, Azure, Google, IBM, and Oracle such as:
    • How a vendor implements TCP/IP constructs within their respective software defined networking (SDN) architectures
    • Which NIST SP 800-53 controls are deployed for customers by default, versus requiring customer configuration, or entirely a customer responsibility
    • Aspects of DNS including DNSSEC, typical configurations for DDoS protection, DNS over TLS (DoT), and DNS over HTTPS (DoH)
    • Domain-based Message Authentication, Reporting & Conformance (DMARC) for email
• Research evolving Federal policy and guidance for application to FedRAMP initiatives and cloud service reviews
• Develop policy/guidance for new/emerging technologies

Required Qualifications

• Bachelors degree in technology related field with 8+ years of experience reviewing or developing IT security and compliance documentation (NIST or FedRAMP). Or Masters + 6 years of experience. Work experience can be substituted with commensurate experience Experience performing risk assessments and analyzing risk
• Understanding of government cryptography requirements
• Strong understanding of cloud architecture, various cloud technologies, and security concepts
• Strong understanding of networking principles and security best practices Strong analytical and writing skills
• Strong technical research skills
• Strong communication skills and ability to explain complex technical concepts to non- technical stakeholders
• Excellent teamwork, organizational, communication, and collaboration skills
• US citizen and eligible for public trust

Desired Qualifications

• At least four (4) years of experience in the IT Security frameworks (FedRAMP, NIST, DoD CMMC, etc.)
• Application development
• Security testing and penetration testing experience
• Vulnerability management experience
• API development and security practices
• Experience developing enterprise security policies and procedures
• OSCAL experience
• CISSP, CISA, CISM or similar certifications
• Experience with operating system or network security management Experience managing incident response and after-action remediation
• Post graduate degree in computer science, cybersecurity or information systems

Overview

Noblis and our wholly owned subsidiaries, Noblis ESI, and Noblis MSD tackle the nation's toughest problems and apply advanced solutions to our clients' most critical missions. We bring the best of scientific thought, management, and engineering expertise together in an environment of independence and objectivity to deliver enduring impact on federal missions. Noblis works with a wide range of government clients in the defense, intelligence and federal civil sectors. Learn more at Noblis -About Us

Why work at a Noblis company?

Our employees find greater meaning in their work and balance the other things in life that matter to them. Our people are our greatest asset. They are exceptionally skilled, knowledgeable, team-oriented, and mission-driven individuals who want to do work that matters and benefits the public. Noblis has won numerous workplace awards. Noblis maintains a drug-free workplace.

Salary Range Explanation

At Noblis we recognize and reward your contributions, provide you with growth opportunities, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, and work-life programs. Our award programs acknowledge employees for exceptional performance and superior demonstration of our service standards. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in our benefit programs. Other offerings may be provided for employees not within this category. We encourage you to learn more about our total benefits by visiting the Benefits page on our Careers site.

Salary at Noblis is determined by various factors, including but not limited to, the combination of education, certifications, knowledge, skills, competencies, and experience, internal and external equity, location, and clearance level, as well as contract-specific affordability and organizational requirements and applicable employment laws. The projected compensation range for this position is provided within the posting and are based on full time status. Part time staff receive a prorated salary based on regularly scheduled hours. The estimated minimum and maximum displayed represents the broadest range for this position (inclusive of high geographic and high clearance requirements), and is just one component of Noblis’ total compensation package for employees.

Posted Salary Range

Equal Employment Opportunity

Noblis is an Equal Opportunity Employer. Employment decisions are made without regard to race (as well as because of or on the basis of traits historically associated with race, including hair texture, hair type, and protective hairstyles such as braids, locks, and twists), color, religion, national origin, gender, sexual orientation, gender identity, age, physical or mental disability, pregnancy, childbirth, lactation and related medical conditions, genetic factors, military/veteran status, or other characteristics protected by law.

Noblis is committed to the full inclusion of all qualified individuals. As part of this commitment, Noblis will ensure that persons with disabilities are provided reasonable accommodations. If reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or to receive other benefits and privileges of employment, please contact employee-relations@noblis.org.