Senior Cloud Security Engineer

Pantheon Data (a Kenific Holding company) is a private, small business based in the Washington, DC, area. Pantheon Data was founded in 2011, initially providing acquisition and supply chain management services to the US Coast Guard. Our service offerings have grown in the past ten years, including infrastructure resiliency, contact center operations, information technology, software engineering, program management, strategic communications, engineering, and cybersecurity.

We have also grown our customer base to include commercial clients. The company has used this experience to expand our service offerings to other agencies within the Department of Homeland Security (DHS), the Department of Defense (DoD), and other Federal Civilian Agencies.

Pantheon Data is seeking a Senior Cloud Security Engineer to own the security architecture, controls, and continuous monitoring of our AWS Gov Cloud environments, which host ML-enabled workloads and applications that process CUI, PII, and PHI. You will design and implement the guardrails that keep these environments secure and compliant: identity and access, encryption, network security, threat detection, vulnerability management, and the evidence that supports ATO and continuous monitoring under FedRAMP High and DoD IL4/IL5.

This role owns the security of the cloud platform  will partner closely with the Dev Sec Ops  Engineer, who owns CI/CD pipeline security and the software supply chain, and the Cloud Operations Engineer, who builds and runs the infrastructure: you set the security standards and controls those teams implement, and you verify that they hold in production. This is a hands‑on engineering role, not a policy‑writing or audit‑only role.

Successful candidates can walk through production cloud security controls they have personally designed and implemented, how they detected and responded to real findings, and the compliance evidence their work produced.

• Identity and Access Management: Design and enforce least‑privilege access across a multi‑account AWS organization using IAM Identity Center, role‑based access, permission boundaries, and service control policies; run periodic access reviews and eliminate long‑lived credentials.
• Security Guardrails: Define and maintain preventive and detective guardrails as code, including service control policies, AWS Config rules and conformance packs, and organization‑wide Cloud Trail, so new accounts and workloads are secure by default.
• Threat Detection and Response: Operate and tune AWS security services (Guard Duty, Security Hub, Inspector, Macie, Detective) and integrate their findings and logs with the organization’s SIEM; lead investigation and containment of cloud security incidents and maintain incident response runbooks.
• Data Protection: Own the encryption and key management strategy (AWS KMS key policies, rotation, FIPS 140‑validated endpoints) and the data perimeter controls protecting CUI, PII, and PHI across storage, databases, and Amazon Bedrock access paths.
• Network Security: Define security group standards, network segmentation, AWS Network Firewall and WAF policies, and restricted‑egress boundaries, and partner with Cloud Operations to implement them.
• Vulnerability and Configuration Compliance: Run continuous vulnerability and configuration scanning across hosts, containers, and cloud resources against DISA STIGs and CIS benchmarks; prioritize findings and track remediation to closure with Cloud Operations and owning teams.
• Compliance and ATO Support: Map technical controls to NIST SP 800‑53; write and maintain control implementation statements; produce continuous monitoring evidence; track POA&M items to remediation; and support assessors…