Job Description
OCT Consulting is a business management and technology consulting firm that supports Federal Government clients. We provide consulting services in the areas of Strategy, Process Improvement, Change Management, Program and Project Management, Acquisition/Procurement, and Information Technology.
OCT currently has an opening for a Cloud Security & Compliance Specialist to support a federal client. The specialist will support the ISSO/SSPO with cloud security operations, FedRAMP-related support activities, and information security compliance for cloud-hosted and modernized IT environments.
This position is contingent upon contract award.
Day-to-day responsibilities include:
Support client cloud migration efforts and IT modernization initiatives from an information security governance perspective, ensuring alignment with existing cloud architectures (AWS, Azure) and EPLC requirements.
Assist in cloud security operations including FedRAMP-related SA&A support, continuous monitoring, and maintaining security authorizations for cloud-hosted and FedRAMP-aligned systems.
Conduct vulnerability and compliance reporting: analyze scan results, identify critical/high vulnerabilities, and provide actionable remediation recommendations; submit monthly reports to the COR.
Support POA&M development, tracking, and monthly updates for cloud-hosted and contractor-hosted systems; ensure all findings are tracked and reflect current remediation status.
Assist with Security Assessment and Authorization (SA&A) package development and coordination including SSPs, RARs, POA&Ms, Contingency Plans, and E-Authentication assessments.
Support compliance with FedRAMP security control baselines, NIST SP 800-53, FISMA, OMB Circular A-130, and applicable agency cloud security policies.
Assist in reviewing and validating ISSO intranet content and security resources; prepare intranet content review reports.
Develop and maintain the Security Authorization Boundary Inventory & Strategy Report, assessing system inventory and recommending optimized authorization boundaries.
Participate in EPLC security reviews and IT acquisition security reviews related to cloud-based solutions and modernization efforts.
Prepare ad hoc technical support deliverables for cloud migration support, acquisition security reviews, and other RMF-related activities as requested.
Support development and maintenance of security training materials for client staff and stakeholders; assist with training delivery as needed.
Ensure HSPD-12/PIV requirements, FIPS 140-2 encryption standards, and CUI handling requirements are met across cloud-operated systems.
Maintain compliance with all agency security training requirements including annual Security Awareness Training (SAT) and role-based training (RBT).
Must be a U.S. Citizen.
Minimum of 3–5 years of experience in cloud security, federal information security compliance, or cybersecurity operations.
Demonstrated experience with cloud security governance, cloud migration security support, and/or FedRAMP-related activities.
Experience with NIST SP 800-53, 800-37, and FedRAMP security control baselines.
Experience performing vulnerability management, compliance scanning, and POA&M tracking in federal environments.
Familiarity with SCAP-compliant automated tools for vulnerability scanning, configuration management, and asset management.
Experience with Governance, Risk, and Compliance (GRC) platforms such as Archer or comparable tools.
Strong technical writing skills sufficient to independently produce clear, accurate, and professionally formatted security and compliance documentation.
Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, Cloud Computing, or a related field (or equivalent work experience).
Ability to obtain a Public Trust (Moderate Risk – Level 5 or higher) background investigation; an HSPD-12/PIV card will be required for facility and network access.
Work will be performed primarily at the agency facility in Hyattsville, MD, with authorized telework on a situational basis. Must be able to commute to the Hyattsville, MD location.
Preferred Qualifications:
- Certified Cloud Security Professional (CCSP), Certified Information Systems Security Professional (CISSP), Certified Authorization Professional (CAP), or equivalent certification.
- Experience supporting HHS or other Federal civilian agency cloud environments (AWS GovCloud, Azure Government).
- Experience with FedRAMP third-party assessment organization (3PAO) processes or JAB authorization activities.
- Familiarity with CIPSEA requirements, Privacy Act compliance, and handling of sensitive federal health statistics data.
- Experience with EPLC security reviews and federal IT acquisition security processes.
OCT offers competitive compensation packages and a full suite of benefits which includes:
- Medical, Dental, and Vision insurance
- Retirement savings 401K plan provided by an industry leading provider with 3% employer contributions of the employee’s gross salary
- Paid Time Off and Standard Government Holidays
- Life Insurance, Short- and Long-Term disability benefits
- Training Benefits
Salary Range: $90,000 – $110,000 yearly commensurate with experience, education, and qualifications.
About OCT Consulting
OCT Consulting LLC is a Small Business (SB) providing professional services and information technology solutions to the Federal government and commercial clients. Founded in 2013, we bring the agility of operations and a management team with a track record of leading successful engagements at major Federal government agencies.
At OCT we believe in creating a work environment where employees can thrive based on their abilities, skills, and achievements. We are dedicated to providing career growth and professional development based on individual merit and fostering a workplace where everyone’s contributions are valued and recognized.
