ISSO/Cloud Security Engineer

This is a full-time, W-2 position supporting a U.S. federal government contract that requires U.S. citizenship and the ability to obtain and maintain a Public Trust clearance. Due to federal background investigation requirements, candidates must have lived in the U.S. for at least 3 of the past 5 years. All work must be performed within the U.S.

About the Role

iAdeptive Technologies is seeking a senior, hands-on ISSO/Cloud Security & DevSecOps Engineer to lead the security authorization for a FedRAMP High environment supporting a federal health agency. Proven ISSO/ATO experience is the primary requirement: this position owns the authorization package and drives the system through authorization on an accelerated timeline.

The role works as part of the cloud team, sharing the same backlog, standups, and pipeline as the engineers, and requires strong AWS and DevSecOps skills. Security is implemented directly in the platform and the CI/CD pipeline rather than managed from a separate compliance function.

Beyond the program, this is a key corporate security role. The position sets the direction for iAdeptive’s enterprise zero-trust and cybersecurity posture, providing strategy, standards, and oversight across the organization. The role therefore requires genuine depth in security authorization and cloud engineering, combined with the judgment to lead security at a corporate level.

How We Work

Security Is Embedded, Not Siloed — This position works as part of the cloud team, sharing the same backlog, standups, and pipeline as the engineers, and embeds security controls into the build rather than reviewing them afterward.

Authorization-Led and Hands-On — The ATO is the anchor of the role — attaining and sustaining the authorization boundary on an accelerated timeline — while remaining hands-on in AWS and the pipeline throughout.

Corporate Security Leadership — Alongside program delivery, the role owns the direction of the company’s zero-trust and cybersecurity posture, setting standards and providing oversight that protect the organization as a whole.

What You Will Do

ISSO / Authorization (Primary)

• Serve as ISSO for a FedRAMP High environment, owning the authorization package and driving it through attainment and ongoing authorization on an accelerated timeline.
• Author and maintain the System Security Plan (SSP), control narratives, and supporting artifacts against NIST 800-53 and agency security baselines.
• Manage Plans of Action and Milestones (POA&Ms), track remediation to closure, and maintain audit-ready evidence.
• Lead Assessment and Authorization (A&A) activities and serve as the security point of contact for assessors and oversight.
• Establish and operate continuous monitoring, including vulnerability scanning, configuration compliance, and security event review.

Cloud Security & DevSecOps (Required)

• Operate as an embedded member of the cloud and platform team, participating in the backlog, standups, and pipeline alongside the engineering staff.
• Implement and validate security controls in AWS GovCloud, including IAM, logging, encryption, network security, and configuration compliance.
• Build and harden the CI/CD pipeline, embedding security gates, scanning, and automated evidence collection through policy-as-code.
• Author and review infrastructure-as-code to enforce secure configuration by default.
• Automate compliance and monitoring to support continuous authorization and efficient post-ATO sustainment.

Corporate Cybersecurity & Zero Trust (Strategy & Oversight)

• Set the direction for the company’s enterprise zero-trust and cybersecurity strategy, standards, and policies.
• Provide security oversight across the organization, including identity, access, endpoint, and network security posture.
• Guide the adoption of security best practices company-wide and advise leadership on cyber risk.

What We’re Looking For

Primary Requirement

• Direct, hands-on ISSO experience in a federal environment, including at least one system taken through Assessment and Authorization (A&A) to an ATO.
• Strong command of NIST 800-53, the RMF, FedRAMP, and FISMA, with the ability to author control narratives accepted by assessors.
• Experience managing POA&Ms, continuous monitoring, and audit-ready evidence.

Required — Cloud & DevSecOps

• Hands-on AWS engineering experience, including IAM, encryption, networking, and configuration compliance (GovCloud preferred).
• Hands-on DevSecOps experience building and securing CI/CD pipelines, infrastructure-as-code, and security a