Principal Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Principal Security Engineer based in the United States.

As a Principal Security Engineer, you will provide advanced security engineering expertise to support the assessment, authorization, and continuous monitoring of cloud-based systems within the federal cybersecurity landscape. You will evaluate complex technology architectures, review security control implementations, and help ensure alignment with FedRAMP, NIST, and agency-specific requirements. Working closely with Cloud Service Providers (CSPs), government stakeholders, and technical teams, you will identify security gaps, assess risks, and recommend practical solutions. You will also lead technical discussions, guide vendors through compliance expectations, and deliver assessments that inform key security decisions. This fully remote opportunity is suited to an experienced security professional who can combine deep technical knowledge, sound judgment, and strong communication skills to strengthen the security and resilience of federal cloud environments.

Accountabilities

In this role, you will lead technical security reviews and provide engineering guidance throughout the FedRAMP authorization and continuous monitoring lifecycle. You will work with government stakeholders and Cloud Service Providers to assess architectures, validate compliance, and address security risks.

• Conduct detailed architecture and technical design reviews across the full technology stack of vendor solutions.

• Evaluate Cloud Service Provider authorization packages to validate secure architecture, alignment with FedRAMP and agency requirements, identify compliance gaps, and advise government stakeholders on overall risk posture.

• Lead architecture interviews with CSPs to verify that critical security controls are appropriately implemented throughout their systems.

• Prepare architecture briefing documents for government program managers and CISOs, summarizing compliance status, technical capabilities, and potential concerns.

• Review and provide detailed feedback on FedRAMP documentation, including System Security Plans, security policies and procedures, supplemental agency guidance, alternative implementation proposals, and risk acceptance documents.

• Work with CSPs to resolve documentation deficiencies and technical security gaps identified during assessments.

• Review post-audit assessment packages, including security assessment plans and reports, vulnerability scans, and penetration test results, and prepare briefings for government leadership.

• Provide security engineering support to agency FedRAMP leadership and contribute to ongoing program activities.

• Support continuous monitoring by reviewing annual submissions, assessing significant change proposals, and evaluating risk acceptance requests.

• Interpret FedRAMP and agency-specific requirements and advise vendors on technical expectations, compliance processes, and implementation approaches.

• Monitor changes to FedRAMP guidance, government cybersecurity directives, emerging technologies, and industry best practices, providing recommendations on their potential impact.

• Assess technologies proposed for use within CSP authorization boundaries and determine their security implications.

• Manage relationships with assigned contractor-owned or contractor-operated systems, ensuring compliance with agency security and privacy requirements.

• Support stakeholders with IT security activities and help ensure project milestones and deadlines are achieved.

• Verify that systems are operated, maintained, and decommissioned in accordance with documented security policies and procedures, including Assessment and Authorization (A&A) requirements.

• Research assigned systems and develop recommendations regarding their security architecture, configuration, and overall protection.

Requirements

The ideal candidate brings substantial hands-on security engineering and architecture experience, particularly within the FedRAMP ecosystem. You should be comfortable evaluating complex cloud environments, interpreting federal security standards, and leading discussions with both technical and non-technical stakeholders.

• At least five years of professional experience in IT security.

• A bachelor's degree in Computer Science, Information Systems, Mathematics, Engineering, or a related discipline, or an additional three years of relevant IT experience in place of the degree.

• Direct experience as a Security Engineer or System Architect analyzing FedRAMP Cloud Service Provider architectures and security control implementations, such as through a Third-Party Assessment Organization (3PAO) or a federal agency's FedRAMP program.

• At least four years of hands-on technical experience as a System Architect or Security Engineer.

• At least four years of experience supporting FedRAMP as an…