Cyber Security Engineer - Senior / Cloud DoS CSS

OneZero Solutions LLC is an employee-centric company that builds technically proficient teams across cyber mission areas. The Senior Cloud Security Engineer owns cloud security engineering for cloud-based and hybrid authorization boundaries, operating the Wiz platform, applying cloud and zero-trust security overlays, documenting inherited controls, supporting key management, and producing authorization evidence for ATOs.

Responsibilities:

• Engineer, operate, and maintain the Wiz platform for cloud-based consular systems: account/subscription onboarding, asset grouping and tagging per CA configuration standards, policy tuning, integrations, and dashboards
• Support agent deployment, vulnerability and compliance scanning, data ingest and sharing, pipeline, and other integration efforts for cloud workloads
• Apply Department and CA cloud-security and zero-trust overlays; identify and document controls inherited from CSPs and DT enterprise services in each system's Inherited Controls Matrix and SSP(RMF Step 2)
• Support cryptographic key management and encryption key lifecycle activities for cloud and hybrid systems
• Develop and maintain cloud architecture, network, and data-flow diagrams and evidence for System Boundary & Data Flow Packages and the Evidence Index(RMF Steps 1 and 3)
• Review cloud vulnerability and compliance scan results within 5 business days of scan completion; drive critical and high findings to closure within Department and BOD timelines; provide closure evidence to ISSOs for POA&M management(RMF Step 6)
• Perform Security Impact Analysis on cloud infrastructure and configuration changes submitted through CA change management; participate in CCB/ECM
• Demonstrate cloud control implementations during Security Control Review Meetings and provide screenshots, logs, and configuration evidence to the SCA(RMF Step 4)
• Support infrastructure-as-code and container image security checks in DevSecOps pipelines and ensure results are captured as SSP evidence(RMF Step 3)
• Coordinate with cloud system operations teams and CSPs to validate remediation and maintain the accredited security posture of cloud systems

Requirements:

• • Eight (8)+ years of cybersecurity or systems engineering experience, including three (3)+ years securing federal workloads in AWS GovCloud, Azure Government, or equivalent
• • Hands-on experience with a CNAPP/CSPM platform (Wiz strongly preferred; Prisma Cloud, Defender for Cloud, or equivalent considered)
• • Working knowledge of NIST SP 800-53 Rev. 5 control implementation in cloud environments and FedRAMP inheritance models
• • Active, final SECRET security clearance; U.S. citizenship
• • DoD 8140/8570 IAT Level III or IAM Level II baseline certification (e.g., CISSP, CASP+, CCSP, CISM) or ability to obtain within 6 months
• • Experience producing authorization evidence (diagrams, configuration exports, scan reports) for ISSOs and assessors
• • Department of State or other federal civilian cloud authorization experience
• • Experience with Terraform/CloudFormation security, Kubernetes/container security, and CI/CD pipeline integration
• • Experience with cryptographic key management services (AWS KMS, Azure Key Vault, HSMs) and FIPS 140-2/140-3 validated modules
• • Wiz (or comparable CNAPP), AWS/Azure native security services, IAM, logging/monitoring, KMS/Key Vault
• • Tenable integration for hybrid boundaries; STIG/CIS benchmarks for cloud OS and services
• • Infrastructure-as-code (Terraform, CloudFormation, Bicep), containers/Kubernetes, CI/CD tooling
• • NIST SP 800-53 Rev. 5, 800-144/145/210 cloud guidance, FedRAMP, zero-trust architecture (NIST SP 800-207)
• • Scripting (Python, PowerShell, Bash) and REST API automation; Visio diagramming
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or an additional four (4) years of directly relevant experience in lieu of degree
• Remote. Duties are performed remotely; the selected candidate must reside within the National Capital Region (NCR)
• Position requires an OpenNet account, DoS PIV badge, multifactor authentication, and adherence to DoS SBU/CUI handling requirements
• Local travel within the National Capital Region; minimal other travel
• Full-time, 40 hours per week. Must be available during Department core hours of 9:00 a.m. - 3:00 p.m. ET, Monday - Friday, and flex working hours as needed to meet CST day-to-day and emergent requirements. No work is performed on Federal holidays or during Government closures. Participates in a rotating on-call schedule supporting 24x7x365 availability of the vulnerability and compliance scanning platforms
• • CCSP, AWS Certified Security - Specialty, or Azure Security Engineer Associate; Wiz certification