Cloud Security Architect, CISO ; RMF

The Cloud Security Architect supports the Chief Information Security Officer (CISO) on Call Order 1 of the Cloud Professional Support Services (CPSS) contract. The cloud broker has more than 1,000 customer environments in Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. The Architect manages the Authorization to Operate (ATO) process under the NIST Risk Management Framework (RMF), maintains the controls that customer environments inherit from the broker, and reviews the security architecture of each new service before it is deployed.

The Architect works with the CISO, Authorizing Officials, system owners, Information System Security Officers (ISSOs), assessors, cloud engineers, and customer technical leads.

• Manages the ATO process for the broker's authorization boundaries and for each customer environment onboarded to it: categorization under FIPS 199, control selection and tailoring, implementation, assessment, authorization, and continuous monitoring.
• Prepares and tracks System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and authorization decision packages.
• Keeps one schedule and one status report for every environment in the authorization process.
• Directs continuous monitoring: annual assessments, significant change reviews, POA&M closure, and vulnerability and configuration findings.
• Briefs the CISO and Authorizing Officials on authorization status, open risks, and risk acceptance requests.
• Aligns packages to the Federal Information Security Modernization Act (FISMA), NIST SP 800-37 Rev. 2, NIST SP 800-53 Rev. 5, NIST SP 800-53A, FIPS 199 and 200, and the Federal Risk and Authorization Management Program (FedRAMP) baselines.
• Coordinates assessors, ISSOs, system owners, and engineers on evidence and schedule.

• Defines and maintains the catalog of controls that customer environments inherit from the broker's boundary, landing zones, and shared services in AWS, GCP, and Azure.
• Maintains customer responsibility matrices for each cloud service provider and service, tied to the provider's current FedRAMP authorization and to the federal regions it offers, such as AWS Gov Cloud (US), Azure Government, and Google Cloud Assured Workloads.
• Builds reusable SSP sections, control narratives, and evidence templates so that a customer environment documents only the controls it implements itself.
• Reviews each onboarding request to confirm which controls the environment inherits and which it owns.
• Reports the share of controls inherited per environment and the time from onboarding request to authorization decision.

• Reviews each new service before deployment: data flows, authorization boundary, identity and access, network segmentation, encryption with FIPS 140 validated modules, logging, and vulnerability management.
• Works with customer technical leads and cloud engineers during onboarding to select the cloud service provider and product stack that meet the customer's requirements and the security controls.
• Writes a security architecture decision for each new service that lists the required controls, the inherited controls, and the residual risk, before the build starts.
• Writes reference architectures and guardrails for accounts, subscriptions, projects, landing zones, and policy as code in AWS, Azure, and GCP.
• Determines whether a new service fits inside the authorized boundary or requires a significant change review.
• Checks the FedRAMP status of each cloud service before it enters the broker's service catalog.
• Sits on the architecture and change review boards.

• Bachelor's degree in information security, computer science,…