Jobs at Fortreum

Leads FedRAMP 20X advisory engagements, performing gap analyses, designing cloud security solutions mapped to Key Security Indicators, and developing client compliance documentation. Builds automated, code-based validation using scripts, APIs, and Infrastructure-as-Code; advises on vulnerability response, encryption, authorization boundaries, SIEM, and continuous compliance monitoring. Tracks regulatory changes, manages client relationships, leads project activities, mentors team members, and delivers high-quality services on schedule.

Conduct network, web, API, mobile, cloud, and social engineering penetration tests for customer engagements. Advise clients on vulnerabilities, remediation, and compliance; coordinate project readiness; prepare reports and deliver readouts. Maintain customer relationships, pursue required certifications, and mentor junior testers. The role is based in a Seattle SCIF with limited periodic travel to client locations.

Deploys and operationalizes the Kovr AI Platform for enterprise and federal customers across cloud, hybrid, and classified environments. Designs secure CI/CD pipelines, AWS infrastructure with Terraform, and Kubernetes platforms using EKS, Helm, and ArgoCD. Implements NIST and OSCAL-aligned controls, observability, automated compliance evidence collection, security scanning, and continuous monitoring. Integrates DevOps tools, troubleshoots production issues, maintains technical documentation, and supports customer-facing infrastructure and security discussions.

Deploy, integrate, and operationalize the Kovr AI Platform across cloud, hybrid, and classified environments. Build and maintain CI/CD pipelines, Terraform-based AWS infrastructure, and Kubernetes/EKS workloads. Implement security controls aligned to NIST 800-53/OSCAL, integrate DevSecOps tooling for automated compliance, support continuous monitoring/audit readiness, troubleshoot production issues, and produce runbooks and documentation while engaging with customers and engineering teams.

Lead and perform penetration tests of networks, web/mobile/API applications and cloud environments; develop testing methodologies and tools; advise on remediation and compliance; produce deliverables and client readouts; mentor junior staff; support Red Team operations and coordinate project readiness with internal teams and customers.

Conduct network, web (API and mobile) and social engineering penetration tests for clients, advise on vulnerabilities and remediation, produce deliverables, coordinate engagements, train junior staff, and meet FedRAMP/A2LA certification requirements. Must support customer-facing activities and occasional onsite travel.

Embed with federal and enterprise customers to deploy, integrate, and operationalize the Kovr AI Platform across cloud, hybrid, and classified environments. Build DevSecOps integrations, automate evidence collection and RMF/ATO processes, write IaC and scripts, troubleshoot complex deployments, enable customer engineering teams, and produce documentation and runbooks to support compliant, repeatable implementations.

Provide high-touch executive support to five C-suite leaders including complex calendar and inbox management, drafting executive correspondence, travel coordination, expense processing, meeting preparation, and special projects. Protect executives' focus time, maintain confidential board/executive files, and produce regular priority summaries. Hybrid role based in Lansdowne, VA (2 days/week).

Lead and perform SOC 1/2 and ISO/IEC 27001-series security assessments for cloud-based systems: define system boundaries, develop testing plans, complete AICPA/ISO audit documentation, conduct stakeholder and technical interviews, produce final reports and certification deliverables, manage project delivery and utilization, and mentor junior staff. Occasional travel to client sites may be required.

Conduct network, web (API/mobile), and social engineering penetration tests; advise customers on vulnerabilities and remediation; prepare deliverables; coordinate engagements; mentor juniors; meet FedRAMP certification requirements; and support cloud-focused security assessments.