Senior Cloud Security Engineer

Company Overview

Pantheon Data (a Kenific Holding company) is a private small business based in the Washington DC area. Pantheon Data was founded in 2011 initially providing acquisition and supply chain management services to the US Coast Guard. Our service offerings have grown in the past ten years including infrastructure resiliency contact center operations information technology software engineering program management strategic communications engineering and cybersecurity. We have also grown our customer base to include commercial clients. The company has used this experience to expand our service offerings to other agencies within the Department of Homeland Security (DHS) the Department of Defense (DoD) and other Federal Civilian Agencies.

Position Overview

Pantheon Data is seeking a Senior Cloud Security Engineer to own the security architecture controls and continuous monitoring of our AWS GovCloud environments which host ML-enabled workloads and applications that process CUI PII and PHI. You will design and implement the guardrails that keep these environments secure and compliant: identity and access encryption network security threat detection vulnerability management and the evidence that supports ATO and continuous monitoring under FedRAMP High and DoD IL4/IL5.

This role owns the security of the cloud platform at runtime. You will partner closely with the DevSecOps Engineer who owns CI/CD pipeline security and the software supply chain and the Cloud Operations Engineer who builds and runs the infrastructure: you set the security standards and controls those teams implement and you verify that they hold in production. This is a hands-on engineering role not a policy-writing or audit-only role. Successful candidates can walk through production cloud security controls they have personally designed and implemented how they detected and responded to real findings and the compliance evidence their work produced.

Responsibilities

• Identity and Access Management: Design and enforce least-privilege access across a multi-account AWS organization using IAM Identity Center role-based access permission boundaries and service control policies; run periodic access reviews and eliminate long-lived credentials.
• Security Guardrails: Define and maintain preventive and detective guardrails as code including service control policies AWS Config rules and conformance packs and organization-wide CloudTrail so new accounts and workloads are secure by default.
• Threat Detection and Response: Operate and tune AWS security services (GuardDuty Security Hub Inspector Macie Detective) and integrate their findings and logs with the organizations SIEM; lead investigation and containment of cloud security incidents and maintain incident response runbooks.
• Data Protection: Own the encryption and key management strategy (AWS KMS key policies rotation FIPS 140-validated endpoints) and the data perimeter controls protecting CUI PII and PHI across storage databases and Amazon Bedrock access paths.
• Network Security: Define security group standards network segmentation AWS Network Firewall and WAF policies and restricted-egress boundaries and partner with Cloud Operations to implement them.
• Vulnerability and Configuration Compliance: Run continuous vulnerability and configuration scanning across hosts containers and cloud resources against DISA STIGs and CIS benchmarks; prioritize findings and track remediation to closure with Cloud Operations and owning teams.
• Compliance and ATO Support: Map technical controls to NIST SP 800-53; write and maintain control implementation statements; produce continuous monitoring evidence; track POA&M items to remediation; and support assessors during ATO and annual assessment activities.
• Security Enablement: Review architectures and infrastructure-as-code changes for security publish secure baseline patterns and mentor engineers on cloud security practices.

Required Skills and Experience

• Bachelors degree in Computer Science Cybersecurity Information Systems Engineering or a related technical field from an accredited university or equivalent professional experience.
• 7 years of hands-on experience in security engineering cloud engineering or a closely related role including 3 years securing production AWS environments.
• Deep hands-on experience with AWS identity and access controls: IAM policy design and troubleshooting cross-account roles federated SSO or IAM Identity Center and organization-level guardrails such as service control policies.
• Experience operating cloud threat detection and security posture tooling AWS-native or comparable and turning findings into prioritized tracked remediation.
• Experience implementing encryption key management and network security controls in cloud environments.
• Working understanding of security compliance frameworks and how they translate into technical controls monitoring and audit evidence.
• Proficiency with infrastructure as code (Terraform preferred) sufficient to write review and enforce security controls as code.
• Scripting proficiency in Python or Bash for security automation.
• Current security certification such as CompTIA Security CISSP or AWS Certified Security Specialty.
• Clear written communication including documenting controls findings and remediation guidance for engineers and assessors.
• Ability to work effectively remotely in cross-functional teams.
• Ability to meet deadlines and produce quality work.
• Proficient in Microsoft Suite software including Outlook Word Excel SharePoint and PowerPoint.

Preferred Skills and Experience

• Direct experience supporting FedRAMP High or DoD IL4/IL5 ATO efforts: control implementation statements SSP contributions POA&M management continuous monitoring and assessor engagement.
• Practical experience applying NIST SP 800-53 DoD RMF and the DoD Cloud Computing SRG in AWS GovCloud including DISA STIG and CIS benchmark compliance.
• Certification that satisfies DoD 8140 requirements for privileged cybersecurity roles.
• Experience with SIEM and log analytics platforms such as Splunk Elastic/OpenSearch or Amazon Security Lake including building detections from CloudTrail VPC Flow Logs and application logs.
• Container and Kubernetes security experience: Amazon EKS hardening pod security standards image scanning and runtime protection.
• Experience securing AI/ML workloads including Amazon Bedrock access controls data perimeter design for model inputs and outputs and data exfiltration risks.
• Policy-as-code experience with tools such as OPA Cloud Custodian or custom AWS Config rules.
• Experience building automated security response such as EventBridge- and Lambda-driven remediation.

Clearance Requirements

Applicants selected will be subject to a security investigation and may need to meet eligibility requirements. Candidates must have the ability to obtain and maintain a Secret clearance; an active Secret clearance is preferred.

Work Location: Reston VA - Remote

• Our company prioritizes the benefits of flexibility and collaboration whether that happens in person or remotely.
• If the position is remote or hybrid you may periodically work from a Pantheon Data office location or client site.
• If this position is assigned to a Pantheon Data office location or client site youll work with colleagues and clients in person as needed for specific client requirements.

Interview Requirement: Candidates who are local to the area should be prepared to participate in an in-person interview as part of the selection process. Candidates outside the local area may be considered for a virtual interview.

Compensation

The salary range for this position is $130000 - $200000. This is not however a guarantee of compensation or salary. Rather salary will be set based on experience geographic location and possibly contractual requirements and could fall outside of this range.

Benefits Overview

We are always looking for good people! Pantheon Data is committed to providing its employees with competitive salaries and benefits in order to increase employee satisfaction and addition to our benefits we also offer SmartBenefits through the Washington Metro Area Transportation Authority where you specify an amount of your pre-tax wages be paid directly to your SmarTrip some cases tuition assistance may be available for continuing education expenses and certifications related to their position. Additional details may be found at Data Important Information

All qualified applicants will be considered for employment without regard to disability status as a protected veteran or any other status protected by applicable federal state local or international law.

As part of the application process you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

If you require reasonable accommodation in completing this application interviewing completing any pre-employment testing or otherwise participating in the employee selection process please direct your inquiries to our Talent Team at or by phone .

This company uses E-Verify to confirm each employees work authorization. For more information click here E-Verify Participation Poster

Required Experience:

Senior IC