Cloud Security

Job Title: Cloud Security & Compliance Engineer

Location: Remote (U.S.-based required)

Engagement Model: Contractor / Fractional – allocated across multiple projects

Department: Product Operations / Engineering

Reports To: Director of Product Operations

Rate: $115 – $130 per hour (based on experience and project allocation)

Overview

We are seeking an experienced Cloud Security & Compliance Engineer to oversee and manage the security posture, compliance framework, and operational integrity of our cloud production environments, including AWS GovCloud deployments for government clients. This role extends beyond single-project responsibilities to provide cybersecurity and compliance oversight across our entire portfolio, encompassing both government and commercial engagements.

The ideal candidate is an autonomous, detail-oriented professional who combines deep expertise in cloud infrastructure security with working knowledge of compliance frameworks such as CJIS, SOC 2, ISO 27001, and NIST This individual will serve as the primary point of contact between engineering, operations, and leadership teams to ensure our environments remain secure, compliant, and audit-ready.

Key Responsibilities

Cloud Security Operations

• Implement, configure and manage secure AWS GovCloud production environments and supporting infrastructure.
• Define and enforce IAM, network segmentation, encryption, and secure CI/CD pipeline standards.
• Execute continuous vulnerability management, patching, and security monitoring using tools such as AWS Security Hub, GuardDuty, CloudTrail, and SIEM solutions.
• Lead incident response, including forensic analysis, remediation, and post-incident reviews.
• Collaborate with product and DevOps teams to embed security-by-design principles throughout the SDLC.
• Oversee and control the secure transfer and deployment of code from non-protected or offshore development environments into GovCloud or other restricted production environments, ensuring that all code promotion follows compliance and security protocols.
• Implement and maintain segregated CI/CD pipelines to ensure no cross-contamination or unauthorized code movement between protected (U.S.) and non-protected (non-U.S.) environments.
• Validate that build artifacts, dependencies, and third-party libraries introduced into protected environments are verified, scanned, and free from foreign access or control risk.

Compliance Management

Lead readiness and ongoing maintenance for CJIS, SOC 2, ISO 27001, and NIST frameworks.

Establish and maintain an Information Security Management System (ISMS) aligned with organizational needs.

Conduct internal audits, gap assessments, and readiness reviews in preparation for external audits.

Manage security documentation, including policies, controls, audit trails, and compliance evidence.

Collaborate with leadership to ensure compliance with data privacy regulations (GDPR, HIPAA, CCPA).

Ensure all code promotion and deployment processes meet CJIS, FedRAMP, and SOC 2 requirements, including maintaining full traceability of personnel, systems, and tools involved in the code transfer from development through production.

Governance, Risk & Oversight

• Own the Cybersecurity Governance Framework across the organization's portfolio, defining risk management protocols and control monitoring processes.
• Define and track security metrics and KPIs; report findings to executive leadership.
• Oversee third-party vendors and subcontractors for compliance with contractual and regulatory standards.
• Serve as the primary contact for client security audits, compliance questionnaires, and technical due diligence.

Qualifications

Required

• Bachelor's degree in computer science, information security, or a related discipline.
  
  5+ years of experience in cloud security engineering, with at least 2 years managing AWS GovCloud or FedRAMP environments.
• Strong understanding of CJIS, SOC 2, ISO 27001, and NIST frameworks.
• Proven experience in IAM, network security, encryption, incident response, and secure DevOps practices.
• Excellent communication skills, with the ability to interface confidently with technical and executive stakeholders.

Preferred

• Security certifications such as CISSP, CISM, CCSP, AWS Certified Security – Specialty, or CompTIA Security+.
• Experience supporting government or regulated industries (public sector, finance, healthcare).
• Knowledge of zero-trust architectures, DevSecOps, and multi-tenant SaaS environments.
• Familiarity with SOC 2 audit tooling, risk registers, and security KPI dashboards.

Why Join Us

You'll be joining a forward-thinking digital product services organization that delivers secure, scalable, and compliant software solutions across industries including government, energy, manufacturing, finance, and technology. This role offers the flexibility of a fractional engagement while allowing you to make a significant impact by shaping and leading our cybersecurity and compliance strategy across multiple mission-critical projects.