Cloud Security Engineer, AWS GovCloud

We are hiring a Cloud Security Engineer to help secure our AWS GovCloud environment from the organizational level, where policy decisions affect every account beneath us. Our team values both technical execution and strong documentation, and this role plays a key part in shaping security guardrails, reinforcing compliance, and advancing ATO readiness. We offer a hybrid work arrangement in the Arlington, VA area, with compensation ranging from $70.00 to $90.00 per hour.

- We require an active Secret clearance or higher.
- We require U.S. citizenship for this program.
- We need hands-on cloud security engineering experience at the AWS Organizations level, including authoring service control policies and resource control policies.
- We need strong experience with IAM permissions boundaries, AWS Config rules, KMS key policy design, and Security Hub remediation.
- We require experience producing ATO-related documentation, including SSP-aligned PPSM evidence, POAMs, and Body of Evidence artifacts.
- We need the ability to work a hybrid schedule in the Arlington, VA area.
- Landing Zone Accelerator experience, especially with custom policy and IAM files, is a plus.
- Familiarity with IL5 and CC SRG control mapping is a plus.

- We author and maintain service control policies and resource control policies across the AWS Organizations environment.
- We design and enforce IAM permissions boundaries to ensure least-privilege access.
- We build and refine AWS Config rules to identify and prevent security baseline drift.
- We create KMS key policies that align with DoD encryption and key management requirements.
- We triage and remediate Security Hub findings and ensure issues remain resolved.
- We produce SSP-aligned PPSM evidence packages, POAMs, and Body of Evidence artifacts to support the ATO package.
- We collaborate with platform and networking teams so our guardrails protect the environment without slowing delivery.