Senior Information Security Engineer (FedRAMP)

Location: Fully remote within the U.S.; up to 10% travel. The position requires working in the U.S. and is subject to a federal Public Trust background check; active U.S. citizenship or a green card with at least 3 consecutive years of U.S. residence is required.

Salary: $180,000–$190,000 USD annually. Total compensation may also include an annual performance bonus, ESPP, enhanced time-off packages, and benefits.

Company

hirify.global Cloud Solutions provides digital cloud fax, healthcare interoperability, HL7/FHIR data exchange, NLP, AI, and secure data transport solutions for healthcare providers, payers, care teams, and technology companies.

What you will do

• Lead FedRAMP Security Operations projects, support annual 3PAO assessments, validate security controls, and prepare annual assessments.
• Manage operating-system patching for up to 350 servers, endpoint protection with FortiClient EMS, AWS backups and disaster recovery with N2WS, and Active Directory access administration.
• Conduct monthly vulnerability scans across operating systems, databases, containers, web applications, and STIG baselines using Nessus and Burp Suite; perform rescans and report remediation status.
• Operate Splunk and other security monitoring capabilities, maintain continuous log and intrusion monitoring, and ensure SOC response and technical support SLAs.
• Review AWS GovCloud security groups, access controls, authorized software, and configuration consistency; support penetration testing, red team exercises, and security impact analysis.
• Coordinate SIAs, SCRs, ConMon activities, and POAMs with the FedRAMP GRC team; lead incident response and disaster recovery exercises, mentor engineers, and maintain security documentation.

Requirements

• Bachelor’s degree in cybersecurity, information technology, computer science, or a related field is preferred; equivalent practical experience is accepted.
• At least 5 years of security engineering or similar technical security experience, including at least 5 years in cybersecurity and 4 years in a security engineering role.
• At least 5 years of experience with vulnerability management tools, including Nessus Pro, Burp Suite, or SonarCube, and practical experience with vulnerability scanning, patch management, and incident response.
• At least 5 years of experience with endpoint protection tools such as FortiClient EMS, CrowdStrike, Carbon Black, or SentinelOne.
• At least 5 years of experience with cloud service providers and cloud security platforms, including cloud-native application protection and tools such as AWS Security Hub.
• At least 4 years of experience with AWS IAM, CloudTrail, GuardDuty, Security Hub, AWS backup and disaster recovery tools such as N2WS, one-time-password systems such as Okta, and SIEM platforms such as Splunk, Elastic, or Exabeam.
• At least 4 years of experience implementing STIGs and baseline configuration management, plus experience with security monitoring and incident response processes.
• At least 2 years of direct experience supporting FedRAMP, NIST 800-53, or similar government security compliance frameworks; experience with NIST 800-53 Rev 5 and FedRAMP is required across the role.
• Hands-on experience with Nessus, Splunk, Burp Suite, FortiClient EMS, and AWS GovCloud; familiarity with regulated cloud environments and enterprise IT infrastructure.
• Ability to analyze complex systems and vulnerability data, manage concurrent projects and deadlines, communicate with technical and non-technical audiences, collaborate with vendors, and mentor junior engineers.
• Basic understanding of GDPR, CCPA, and other product security compliance frameworks; ongoing cybersecurity training and continuing education are encouraged.

Nice to have

• Experience supporting or leading FedRAMP High environments or other high-impact government-authorized systems.
• Experience with POAM management, GRC teams, penetration testing, and red team operations in cloud or hybrid environments.
• Security automation experience with Python, PowerShell, or Bash.
• Knowledge of ManageEngine ServiceDesk Plus, policy and procedure development, and compliance documentation.
• Previous security-team mentorship or leadership experience and strong written communication skills.
• Experience supporting a SOC or 24/7 security monitoring environment.

Culture & Benefits

• Fully remote work within the U.S. with up to 10% travel.
• Reliable high-speed internet is required, along with the ability to sit and use screens for extended periods.
• Annual performance bonus, ESPP, enhanced time-off packages, and benefits may be included in the negotiable total compensation package.
• Work includes cross-functional collaboration, security awareness training, vendor reviews, industry and government security forums, and coverage support for other security team members.
• Visa sponsorship is not available.