Cloud Compliance Engineer

About the Role

Our ability to serve defense, aerospace, and federal customers depends on building compliance into the platform from the beginning.

We need an engineer who understands both sides of that challenge: how to operate production cloud infrastructure and how to prove that its controls are properly designed, implemented, and continuously maintained.

You will connect engineering, security, compliance, legal, and program stakeholders, ultimately turning regulatory requirements into systems for our users without weakening the compliance boundary.

Why This Role

Many compliance roles identify gaps and hand them to engineering. In this role, you will help close those gaps yourself and effectively build this program from the ground up.

You will work directly in the cloud environment: building landing zones, configuring identity and network boundaries, writing Terraform, integrating security tooling, automating evidence collection, remediating vulnerabilities, and supporting assessors with technically accurate control implementations.

You will partner with our existing internal Platform and Engineering to leverage our existing expertise codifying, securing and scaling our solutions.

You will have meaningful ownership over the architecture and operating model, not simply responsibility for maintaining documentation after decisions have already been made.

What You'll Do

• Build the regulated cloud environment.
• Design and operate secure cloud landing zones for ITAR-controlled and (future) FedRAMP-aligned workloads, including account or subscription structure, network segmentation, approved regions, data residency, encryption, centralized logging, and administrative access.
• Implement compliance as code.
• Use infrastructure-as-code and policy-as-code to deploy repeatable controls, prevent configuration drift, enforce approved architectures, and create traceable evidence of system changes.
• Engineer identity and access controls.
• Implement least privilege, separation of duties, privileged-access workflows, MFA, service identities, periodic access reviews, and auditable onboarding and offboarding processes.
• Secure the software-delivery lifecycle.
• Integrate compliance requirements into CI/CD pipelines, source control, artifact management, container or workload security, dependency scanning, secrets management, change approval, and production deployment.
• Own the technical control environment.
• Translate ITAR and FedRAMP requirements into specific configurations, services, processes, and engineering ownership. Maintain accurate control narratives, architecture diagrams, data flows, inventories, responsibility matrices, and implementation evidence.
• Automate continuous monitoring.
• Build or integrate tooling for vulnerability management, configuration monitoring, log aggregation, alerting, evidence collection, asset inventory, and control-health reporting.
• Drive remediation.
• Triage technical findings, determine root cause, define corrective actions, and work with engineering teams to close vulnerabilities, assessment findings, and Plans of Action and Milestones within required timelines.
• Manage the technical authorization program.
• Maintain the system boundary and technical portions of the authorization package.
• Coordinate engineering readiness for assessments, significant changes, penetration tests, disaster-recovery exercises, and ongoing authorization activities.
• Partner with assessors and customers.
• Serve as a technical point of contact for 3PAOs, auditors, federal customers, defense customers, and internal reviewers. Demonstrate control operation and provide concise, technically defensible responses to questions and findings.
• Prepare for incidents.
• Engineer and test logging, detection, containment, recovery, and evidence-preservation capabilities for regulated environments. Participate in incident-response exercises and post-incident remediation.

What Success Looks Like

• You will have:
• Established a documented, repeatable cloud architecture for regulated workloads.
• Implemented high-priority technical controls through infrastructure and policy automation.
• Created clear traceability from regulatory requirements to configurations, owners, and evidence.
• Reduced manual compliance work through automated evidence collection and control monitoring.
• Established repeatable vulnerability, remediation, change-management, and continuous-monitoring processes.
• Prepared the technical environment and engineering organization for customer review or formal assessment.
• Made the compliant path the easiest path for product, customer and platform engineers.

What We're Looking For

• 5+ years of hands-on experience in cloud, platform, infrastructure, DevSecOps, or security engineering.
• Significant production experience with AWS, Azure, or Google Cloud Platform, including deep knowledge of identity, networking, encryption, logging, monitoring, and workload isolation.
• Direct responsibility for the technical implementation of an ITAR or FedRAMP program. Advisory exposure alone is not sufficient.
• Experience translating regulatory or security controls into cloud architecture, configurations, operational processes, and assessment evidence.
• Strong infrastructure-as-code experience with Terraform, CloudFormation, Bicep, Pulumi, or an equivalent platform.
• Experience building or operating secure CI/CD pipelines and integrating vulnerability, configuration, dependency, container, or application-security tooling.
• Working knowledge of NIST SP 800-53 controls and the technical artifacts used in regulated programs, such as system boundaries, data-flow diagrams, SSP content, inventories, control evidence, and POA&Ms.
• Ability to troubleshoot and remediate issues directly in production-grade cloud systems.
• Experience working with assessors, auditors, security teams, and engineering owners to resolve technical findings.
• Strong written communication. You can explain exactly how a control is implemented, where it operates, who owns it, and what evidence proves it.
• Because this role may access ITAR-controlled technical data, the successful candidate must qualify as a U.S. person under ITAR 120.62.
• Ability to obtain and maintain a U.S. government security clearance if required for future programs. A clearance is not required unless specifically stated by the company.

Nice to Have

• Hands-on experience with AWS GovCloud, Google Cloud Platform Assured Workloads, Azure Government, or another regulated cloud environment.
• Experience taking a cloud service through FedRAMP readiness, assessment, authorization, or continuous monitoring.
• Experience operating an ITAR technical-control program, including access restrictions, data handling, approved cloud regions, export-controlled technical data, and foreign-person access prevention.
• Familiarity with CMMC, DFARS, NIST SP 800-171, FIPS 140-validated cryptography, or DoD Impact Levels.
• Experience with AWS Organizations, Control Tower, IAM Identity Center, SCPs, KMS, CloudHSM, CloudTrail, Config, Security Hub, GuardDuty, Inspector, Macie, or comparable services in other Clouds.
• Experience with Kubernetes, containers, service meshes, zero-trust architectures, SIEM platforms, CSPM/CNAPP tooling, or policy engines such as OPA.
• Experience implementing automated evidence collection using OSCAL or a governance, risk, and compliance platform.
• Experience in defense, aerospace, manufacturing, critical infrastructure, or another highly regulated industry.
• Security or cloud certifications such as CISSP, CCSP, AWS Security Specialty, AWS Solutions Architect, Azure Security Engineer, or equivalent.

The Team

You will work closely with Cloud Infrastructure, Security, Product Engineering, Legal, and GRC (Compliance).

You will provide technical leadership for the regulated-cloud program while helping engineering teams understand and own the controls implemented within their services.

This role will mentor other engineers and lead technical workstreams, but its primary responsibility is hands-on implementation and operation.

This is an opportunity to build the engineering foundation behind a critical compliance program, enabling many new business revenue streams and creating significant impact!