Consultant Cybersecurity Compliance & Advisory

SecureIT is hiring a Consultant to deliver cybersecurity compliance and FedRAMP advisory support focused on CR26/NIST 800-53-based readiness, gap analysis, and strategy development.

Responsibilities

• Provide technical and FedRAMP subject-matter guidance to clients on assigned engagements.
• Produce accurate advisory recommendations, including gap analyses and supporting deliverables.
• Lead or participate in client discussions on complex FedRAMP topics under the Manager’s direction.
• Support knowledge transfer by delivering technical guidance to Associates and Sr. Associates.
• Escalate technical, scope, or client-risk concerns in a timely manner to the Manager.
• Discuss complex FedRAMP areas, including:
  • Container security
  • Boundary protection
  • FIPS 140 validated encryption
  • Phishing-resistant MFA
  • DNSSEC
• Analyze system boundaries and advise clients according to FedRAMP rules, or relevant requirements for DoW FedRAMP equivalency and GovRAMP authorization.
• Deliver technology-specific guidance for cloud platforms and security tooling, including:
  • Cloud: AWS, Azure, GCP
  • Environments/OS: Windows, Unix
  • Containers and orchestration: Docker, Kubernetes
  • Security tools: Okta, Wiz, Splunk (and others as applicable)
• Explain applicable CR26 rules, identify gaps in CSP processes, and recommend corrective actions.
• Review CSP-defined KSI metrics to detect gaps (or identify control gaps for rev5 baseline engagements) and recommend remediation.
• Document how the CSP implements CR26 rules and KSIs (or rev5 controls) for the SDR, including verification and validation approach and required artifacts.
• Use a “what-will-assessors-look-for” approach to help ensure artifacts withstand scrutiny from assessors, PMO, and agency customers.
• Advise clients on FedRAMP certification processes, including timelines and Continuous Monitoring (ConMon) expectations.
• Help clients plan, establish, and execute regular ConMon processes, including ongoing vulnerability management after VDR/VER and additional CR26 processes.
• Provide subject-matter guidance on complex ConMon and ongoing reporting issues in CR26, and support performance where needed.
• Support team members with FedRAMP requirements, cloud architectures, DevSecOps, and security tools/technologies.
• Contribute lessons learned, templates, and technical guidance to service-line playbooks.
• Conduct deep technical research on specific matters as directed by SMEs or the CKO.

Requirements

• 6+ years of experience in cybersecurity compliance, risk management, or advisory services in a professional services capacity.
• 2+ years of experience with FedRAMP engagements.
• Strong knowledge of legacy FedRAMP requirements and NIST 800-53 control families; growing understanding of CR26 rules and 20x KSIs.
• Understanding of cloud computing technologies: AWS, Azure, and/or GCP.
• Experience advising on cloud architecture, security configurations, and compliance best practices.
• Familiarity with: container security, Infrastructure as Code, boundary protection, FIPS 140 validated encryption, phishing-resistant MFA, DNSSEC, and other modern cybersecurity mechanisms/technologies.
• Strong communication skills for explaining complex compliance and security concepts to non-technical stakeholders.
• Ability to present solutions clearly to both C-level executives and technical teams.
• Strong analytical and problem-solving skills for practical solutions to complex security/compliance challenges.
• Effective time management and adaptability in a rapidly changing environment.
• Strong writing and documentation skills.
• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or related field (advanced degrees are a plus).
• At least one industry-recognized certification, such as:
  • CISSP, CCSP, CCSK, CCAK
  • Hyperscaler-specific certifications (e.g., AWS, Azure, GCP)

Technologies

• NIST 800-53
• FedRAMP
• CR26 rules
• KSIs
• rev5
• DoW FedRAMP equivalency
• GovRAMP authorization
• ConMon
• VDR/VER
• SDR
• AWS, Azure, GCP
• Windows, Unix
• Docker, Kubernetes
• Okta, Wiz, Splunk
• DevSecOps
• Infrastructure as Code
• FIPS 140 validated encryption
• Phishing-resistant MFA
• DNSSEC

How Success Is Defined

• Deliver accurate, practical FedRAMP and technical recommendations and documentation that move clients toward certification.
• Maintain clear, credible communication with stakeholders from technical teams through executive leadership.
• Ensure system boundaries and CR26/KSI or rev5 control implementations are well-scoped and support successful assessment and PMO review.
• Enable sustainable ConMon processes clients can run independently.
• Provide visible technical support and knowledge transfer to Associates and Sr. Associates.

Pay Range / Location

• USD 119,000 - 160,000 per year
• Reston, VA (hybrid)
• US location