Cloud Compliance Engineer
Fedramp, AWS, ITAR are Mandatory
Build and Operate the Technical Foundation for Regulated Cloud Programs
We are looking for a hands-on Cloud Compliance Engineer and technical leader to design,
implement, and operate cloud environments that handle export-controlled and
government-regulated workloads.
This is an engineering role and not a policy-only or audit-coordination position. You will translate
ITAR, FedRAMP, and related security requirements into working cloud architecture,
infrastructure-as-code, deployment controls, monitoring, and operational evidence. You will own
the technical side of the compliance program and ensure that our documented controls
accurately reflect how the environment operates.
About the Role
Our ability to serve defense, aerospace, and federal customers depends on building compliance
into the platform from the beginning.
We need an engineer who understands both sides of that challenge: how to operate production
cloud infrastructure and how to prove that its controls are properly designed, implemented, and
continuously maintained. You will connect engineering, security, compliance, legal, and program
stakeholders, ultimately turning regulatory requirements into systems for our users without
weakening the compliance boundary.
Why This Role
Many compliance roles identify gaps and hand them to engineering. In this role, you will help
close those gaps yourself and effectively build this program from the ground up.
You will work directly in the cloud environment: building landing zones, configuring identity and
network boundaries, writing Terraform, integrating security tooling, automating evidence
collection, remediating vulnerabilities, and supporting assessors with technically accurate
control implementations. You will partner with our existing internal Platform and Engineering to
leverage our existing expertise codifying, securing and scaling our solutions.
You will have meaningful ownership over the architecture and operating model, not simply
responsibility for maintaining documentation after decisions have already been made.
What You'll Do
Build the regulated cloud environment.
Design and operate secure cloud landing zones for ITAR-controlled and (future)
FedRAMP-aligned workloads, including account or subscription structure, network
segmentation, approved regions, data residency, encryption, centralized logging, and
administrative access.
Implement compliance as code.
Use infrastructure-as-code and policy-as-code to deploy repeatable controls, prevent
configuration drift, enforce approved architectures, and create traceable evidence of
system changes.
Engineer identity and access controls.
Implement least privilege, separation of duties, privileged-access workflows, MFA,
service identities, periodic access reviews, and auditable onboarding and offboarding
processes.
Secure the software-delivery lifecycle.
Integrate compliance requirements into CI/CD pipelines, source control, artifact
management, container or workload security, dependency scanning, secrets
management, change approval, and production deployment.
Own the technical control environment.
Translate ITAR and FedRAMP requirements into specific configurations, services,
processes, and engineering ownership. Maintain accurate control narratives,
architecture diagrams, data flows, inventories, responsibility matrices, and
implementation evidence.
Automate continuous monitoring.
Build or integrate tooling for vulnerability management, configuration monitoring, log
aggregation, alerting, evidence collection, asset inventory, and control-health reporting.
Drive remediation.
Triage technical findings, determine root cause, define corrective actions, and work with
engineering teams to close vulnerabilities, assessment findings, and Plans of Action and
Milestones within required timelines.
Manage the technical authorization program.
Maintain the system boundary and technical portions of the authorization package.
Coordinate engineering readiness for assessments, significant changes, penetration
tests, disaster-recovery exercises, and ongoing authorization activities.
Partner with assessors and customers.
Serve as a technical point of contact for 3PAOs, auditors, federal customers, defense
customers, and internal reviewers. Demonstrate control operation and provide concise,
technically defensible responses to questions and findings.
Prepare for incidents.
Engineer and test logging, detection, containment, recovery, and evidence-preservation
capabilities for regulated environments. Participate in incident-response exercises and
post-incident remediation.
What Success Looks Like
You will have:
Established a documented, repeatable cloud architecture for regulated workloads.
Implemented high-priority technical controls through infrastructure and policy
automation.
Created clear traceability from regulatory requirements to configurations, owners, and
evidence.
Reduced manual compliance work through automated evidence collection and control
monitoring.
Established repeatable vulnerability, remediation, change-management, and
continuous-monitoring processes.
Prepared the technical environment and engineering organization for customer review or
formal assessment.
Made the compliant path the easiest path for product, customer and platform engineers.
What We're Looking For
5+ years of hands-on experience in cloud, platform, infrastructure, DevSecOps, or
security engineering.
Significant production experience with AWS, Azure, or Google Cloud Platform, including deep knowledge
of identity, networking, encryption, logging, monitoring, and workload isolation.
Direct responsibility for the technical implementation of an ITAR or FedRAMP program.
Advisory exposure alone is not sufficient.
Experience translating regulatory or security controls into cloud architecture,
configurations, operational processes, and assessment evidence.
Strong infrastructure-as-code experience with Terraform, CloudFormation, Bicep,
Pulumi, or an equivalent platform.
Experience building or operating secure CI/CD pipelines and integrating vulnerability,
configuration, dependency, container, or application-security tooling.
Working knowledge of NIST SP 800-53 controls and the technical artifacts used in
regulated programs, such as system boundaries, data-flow diagrams, SSP content,
inventories, control evidence, and POA&Ms.
Ability to troubleshoot and remediate issues directly in production-grade cloud systems.
Experience working with assessors, auditors, security teams, and engineering owners to
resolve technical findings.
Strong written communication. You can explain exactly how a control is implemented,
where it operates, who owns it, and what evidence proves it.
Because this role may access ITAR-controlled technical data, the successful candidate
must qualify as a U.S. person under ITAR 120.62.
Ability to obtain and maintain a U.S. government security clearance if required for future
programs. A clearance is not required unless specifically stated by the company.
Nice to Have
Hands-on experience with AWS GovCloud, Google Cloud Platform Assured Workloads, Azure
Government, or another regulated cloud environment.
Experience taking a cloud service through FedRAMP readiness, assessment,
authorization, or continuous monitoring.
Experience operating an ITAR technical-control program, including access restrictions,
data handling, approved cloud regions, export-controlled technical data, and
foreign-person access prevention.
Familiarity with CMMC, DFARS , NIST SP 800-171, FIPS 140-validated
cryptography, or DoD Impact Levels.
Experience with AWS Organizations, Control Tower, IAM Identity Center, SCPs, KMS,
CloudHSM, CloudTrail, Config, Security Hub, GuardDuty, Inspector, Macie, or
comparable services in other Clouds.
Experience with Kubernetes, containers, service meshes, zero-trust architectures, SIEM
platforms, CSPM/CNAPP tooling, or policy engines such as OPA.
Experience implementing automated evidence collection using OSCAL or a governance,
risk, and compliance platform.
Experience in defense, aerospace, manufacturing, critical infrastructure, or another
highly regulated industry.
Security or cloud certifications such as CISSP, CCSP, AWS Security Specialty, AWS
Solutions Architect, Azure Security Engineer, or equivalent.
The Team
You will work closely with Cloud Infrastructure, Security, Product Engineering, Legal, and GRC
(Compliance). You will provide technical leadership for the regulated-cloud program while
helping engineering teams understand and own the controls implemented within their services.
This role will mentor other engineers and lead technical workstreams, but its primary
responsibility is hands-on implementation and operation.
This is an opportunity to build the engineering foundation behind a critical compliance program,
enabling many new business revenue streams and creating significant impact!
