Principal, FedRAMP Advisory

Coalfire Systems

Coalfire is an EEO employer. We celebrate diversity and are committed to respecting one another, embracing individual differences, and creating an inclusive environment for all employees.

About Coalfire

Coalfire is on a mission to make the world a safer place by solving our clients’ hardest cybersecurity challenges. We work at the cutting edge of technology to advise, assess, automate, and ultimately help companies navigate the ever‑changing cybersecurity landscape. We are headquartered in Chicago, Illinois with offices across the U.S. and U.K., and we support clients around the world. We are thought leaders, consultants, and cybersecurity experts, but above all else, we are a team of passionate problem‑solvers who are hungry to learn, grow, and make a difference.

The Principal Consultant (SME) is a Public Sector compliance (NIST, FedRAMP, CMMC, FISMA, DoD SRG, GovRAMP, etc.) subject‑matter expert with strong technical and business experience. The role involves evaluating and enhancing the security of complex systems, mentoring team members, researching regulatory topics, communicating findings, engaging with regulatory bodies, publishing community‑focused content, and supporting business growth through sales, marketing, and SOP development.

• Work with industry and standards bodies to provide security expertise.
• Collaborate with internal Coalfire teams to drive customer success.
• Scope and lead on‑site engagements, including pre‑sales calls, onsite visits, and custom solution proposals.
• Develop technical content such as security plans, procedures, policies, and white papers.
• Lead delivery engagements and deliver compliance roadmaps, gap assessments, and architecture guidance.
• Manage project status, identify roadblocks, and keep stakeholders informed.
• Communicate customer and partner feedback to engineering, support, and business teams.
• Serve as the practice SME for escalations, sales/marketing support, and practice profitability.
• Identify process improvements and mentor delivery personnel on methodologies, tools, and quality topics.
• Author industry‑wide service line thought‑leadership such as methodologies, templates, white papers, and work instructions.
• Develop and deliver industry‑specific training and present at conferences and webinars.
• Ensure client satisfaction throughout all engagement phases.
• Maintain professional certifications and stay current with industry developments.
• Collaborate with project managers, quality, sales, and delivery teams to meet deliverables.
• Establish account relationships and identify upsell/cross‑sell opportunities, escalating to sales.
• Travel up to 20% of the time.

• University degree in computer science, information systems, security, business, or equivalent experience.
• Certification: CISSP, CISM, CISA, CCSP, or equivalent.
• 7+ years in IT security audit, assessment, compliance, risk management, or data privacy.
• Awareness of current information risk and compliance innovations, trends, challenges, and solutions.
• Knowledge of standards/frameworks (NIST, ISO, CIS Top 20, ISSA, CSA CMM, Privacy by Design, FAIR, etc.).
• Understanding of enterprise risk and security operational practices.
• Familiarity with security solutions, tools, and utilities.
• Strategic leadership experience and ability to influence internally and externally.
• Experience building compliance frameworks and mapping between requirements.
• Broad security expertise across sub‑domains such as encryption, identity, incident response, and more.
• Hands‑on technical expertise is a plus.
• Risk assessment methodology and risk reporting experience for executive leadership.
• Proven ability to write complex technical documents for varied enterprise audiences.

7+ years of experience working with one, more, or a combination of the following:

• National Institute of Standards and Technology (NIST) frameworks (800 series)
• CMMC
• FedRAMP
• DoD CC SRG and/or RMF
• FISMA
• GovRAMP (State
  
  RAMP)

• Big Four advisory/consulting experience
• Dev Sec Ops  experience
• CMMC CCP or CCA certification
• AWS, Azure, or Google Cloud Platform certification
• Open Fair or related certification, CCBP
• Ven…