Cloud Engineer - FedRAMP
Why Join Us
Under FedRAMP, compliance is no longer a document—it’s a set of Key Security Indicators (KSIs): measurable security outcomes validated through automation, continuously. Coalfire organizes its delivery engineering into capability-focused teams, each owning a set of KSI domains such as identity and access management, monitoring and logging, change management, or incident recovery. We’re looking for a Cloud Engineer to go deep on a team’s domains—building the standard implementation once, making it deployable anywhere, and landing it in client environment after client environment, getting better every time. If you’re driven by a desire to innovate, excel at operational excellence, and thrive in a collaborative environment, come be part of a team committed to making the world a safer place.
· Design and implement the security capabilities that satisfy FedRAMP’s Key Security Indicators (KSIs) within your team’s specialty domains.
· Build the Security Decision Record (SDR) automation that deploys those capabilities repeatably across many client environments—infrastructure-as-code, pipelines, and configuration baselines, not one-off builds.
· Develop automated validation and continuous-monitoring evidence for each capability, so the certified state is provable every day.
· Deploy into client environments as the subject-matter expert for your domain: land the capability, integrate it with the client’s stack, troubleshoot, and harden.
· Bring lessons from every deployment back to your team, improving the standard implementation for the next client.
· Mentor junior team members by reviewing their work, sharing best practices, and guiding them through troubleshooting and operational standards.
· Contribute to documentation, runbooks, and machine-readable compliance artifacts.
· Support both new FedRAMP environment builds and the modernization of existing ones.
· Author and peer review detailed design and security documentation, inclusive of vendor best practices.
WORK ENVIRONMENT/TRAVEL REQUIRED:
Travel: Approximately 10%, driven by client needs
U.S. citizenship is required, as this position supports federal compliance programs.
What You'll Bring· BS or above in a related Information Technology field or equivalent combination of education and experience
· 5+ years in cloud, security, or platform engineering
· 5+ years supporting cloud architecture, design, implementation, operations, and automation in AWS, Azure, or GCP
· Experience with Infrastructure-as-Code and orchestration/automation tools such as Terraform and Ansible
· Automation-first mindset with strong Infrastructure-as-Code (Terraform or equivalent), CI/CD, and scripting (Python, Go, or similar); exposure to policy-as-code
· Hands-on depth with at least one major cloud platform (AWS, Azure, or GCP) and its native services
· Working knowledge of NIST 800-53, FedRAMP, or comparable security control frameworks
· The instinct to solve a problem once, properly, and package the solution so it works everywhere
· Excellent communication, organizational, and problem-solving skills
· Effective documentation skills, including technical diagrams and written descriptions
· Ability to work independently and as part of a team with a professional attitude and demeanor
· Critical thinking, and the ability to balance security requirements with mission needs
REQUIRED CERTIFICATIONS:
· Associate-level (or higher) certification in AWS, Azure, or GCP
· Direct familiarity with FedRAMP 20x and Key Security Indicators (KSIs)
· Experience with OSCAL or JSON machine-readable compliance formats
· Depth in a likely specialty area: identity (SSO, phishing-resistant MFA), SIEM and log pipelines, vulnerability management, or resilience engineering
· Relevant certifications such as cloud security specialty certifications, CISSP, or GIAC
· Previous experience supporting clients from within a professional services organization
· Familiarity with configuration baseline standards such as CIS Benchmarks & DISA STIG
· Familiarity with frameworks such as FedRAMP, FISMA, HIPAA, HITRUST, or PC