Coalfire

Artificial Intelligence

• Deliver on the most technically complex application, network, and adversary services engagements.
• Architect and build AI-powered platforms — including agentic systems — that automate reconnaissance, attack path discovery, exploitation, and reporting across the offensive lifecycle.
• Maintain a relentless focus on outputs that move the P&L: tooling that compounds across engagements and improves over time.
• Act as a hands-on senior leader in secure software development, model integration, and the engineering discipline required to build durable internal platforms.
• Act as a trusted advisor to our clients’ senior leadership on security matters, providing insights and recommendations to inform strategic decision-making.
• Collaborate with our sales and marketing teams to drive opportunity identification and rapidly grow the practice.

Senior Principal, AI Testing – Development

QA Engineer

• Join a collaborative and dynamic team of cybersecurity professionals to conduct cutting-edge penetration testing across a wide range of technologies and environments.
• Play a key role in identifying vulnerabilities, simulating real-world cyberattacks, and helping our clients strengthen their security posture.
• Conduct internal and external network penetration testing, application security assessments (browser-based, API, mobile), cloud environment testing, social engineering engagements, and wireless assessments.

Consultant, Penetration Tester

Consultant

• Conduct human threat engagements including social engineering, phishing, vishing, physical assessments, and human risk evaluations.
• Prepare, review, and approve Human Threat reports to meet quality requirements.
• Manage priorities and tasks to achieve delivery utilization targets.
• Advise clients on all testing and assessment activities in a timely and professional manner.
• Ensure client deliverables and services are delivered on time.
• Continuous professional development in maintaining industry specific certifications and staying current on emerging human threat tactics and trends.
• Establish and maintain positive collaborative relationships with clients and stakeholders.
• Identify up-sell and cross-sell opportunities and escalate to sales.
• Collaborate with project managers, quality management, sales, and other delivery team members to drive customer satisfaction and meet project deliverables.
• Mentor junior consultants in social engineering tradecraft, client communications, reporting, and engagement execution.
• Contribute to the development and refinement of Human Threat methodologies, tooling, playbooks, and service offerings.
• Contribute to thought leadership through research, blogs, whitepapers, webinars, and conference presentations on human threat, and related security topics.
• Support the development of the Human Threat practice through original research, service innovation, and externally facing industry content.
• Represent the Coalfire at industry events, client briefings, and conferences as a subject matter expert.
• Contribute to other offensive security engagements, as needed, based on business demand, skillset alignment, and delivery priorities when not assigned to Human Threat assessments.
• Perform other responsibilities as needed in support of client delivery, practice development, and team success.

Senior Consultant, Human Threats

Security Engineer

• Support as the principal advisor to the information system owner (SO), ISSM, CISO on all matters involving the security of assigned information systems.
• Maintain detailed knowledge and expertise required to manage the security aspects of assigned information systems.
• Ensure that the appropriate operational cybersecurity posture is maintained for assigned systems to provide confidentiality, integrity, and availability of information systems.
• Complete and keep updated security documentation, such as SIA, SSP, POA&M, Configuration Management Plan, Vulnerability Reports, etc.
• Participate in planning and management of all phases of the Risk Management Framework (RMF) Security Assessment and Authorization (SAA) process.
• Advise system owners on all matters, involving the security of assigned IT systems.
• Conduct continuous monitoring of implemented security controls to ensure that they are implemented correctly and operating as intended.
• Assess the cybersecurity impact of changes to assigned IT systems and document findings in a security impact analysis (SIA) report.
• Provide the required system access, information, and documentation to security assessment and audit teams.

Information System Security Officer – Hybrid

• Leads audits and assessments including audit planning, evidence review, controls evaluation, and client interviews.
• Prepare relevant frameworks assessment reports and attestations.
• Manage priorities, tasks and hours on projects in coordination with project managers to meet delivery utilization targets.
• Ensure all deliverables meet Coalfire quality standards and timelines.
• Proactively escalate client or project risks to management.Interface with clients throughout the engagement, including executive and technical stakeholders
• Build and maintain strong, collaborative client relationships
• Maintain industry certifications and deepen subject matter expertise through continuous professional development.
• Travel up to 30% as required

Senior Consultant, Technical Payments – PCI QSA, P2PE, PIN

Cloud Engineer

• Become a member of a highly-collaborative engineering team offering a unique blend of engineering solutions.
• Serve as the cloud SME to clients within design, architecture, and deployment engagements in the AWS, Azure, or GCP space using automated orchestration and configuration management techniques.
• Perform as a partner with leading Cloud Service Providers (CSPs) and enterprises to meet security goals and pave the way for digital transformation and modernization.
• Design and implement security tooling solutions such as Tenable, Trend Micro, AquaSec, Microsoft Defender, Burp Suite and others.
• Evaluate technical solutions against NIST/FedRAMP controls.
• Engage in developing client cloud and security strategies, vision-state architectures, roadmaps, and planning activities.
• Engage with clients to perform cloud configuration and maturity reviews.
• Coordinate with clients and team members to identify the right balance of defense-in-depth techniques to translate customer’s goals into a secure and effective solution.
• Engage in designing and implementing secure and compliant enterprise servers, network infrastructure, boundary protection, and cloud architectures using Infrastructure-as-Code.
• Work across a myriad of technology stacks in the leading cloud providers like AWS, Azure, and GCP, researching how to understand and utilize native services in deployments.
• Provide support to the security assessment and authorization process.
• Authoring and peer review of detailed design documentation, including security documentation and inclusive of vendor best practices

• Conduct audits/assessments including audit plan preparation, review of documentation and evidence, evaluation of procedures, and client interviews.
• Assess client provided documentation for compliance with a variety of standards.
• Prepare and review assessment reports.
• Educate and interpret compliance activities for clients
• Manage priorities and tasks to achieve delivery utilization targets.
• Ensures quality products and services are delivered on time per Coalfire quality standards.
• Continuous professional development in maintaining industry specific certifications. Maintains strong depth of knowledge in the practice area.
• Collaborates with project managers, quality management and/or other delivery team members to drive customer satisfaction and meet project deliverables.
• Establish and maintain positive collaborative relationships with clients and stakeholders
• Identifies upsell and cross sell opportunities and escalates to leadership team
• Evaluate the design and effectiveness of technology controls throughout the business cycle
• Travel up to 20%

Consultant, SOC Assessment

Project Manager

• Serve as the principal information assurance advisor to the Chief Information System Officer (CISO) and IT Program Manager/System Owner.
• Collaborate with Chief Information Officer (CIO) office to ensure security/privacy/A&A requirements are met.
• Lead a team of information assurance / security engineering professionals supporting unclassified networks and applications.
• Ensure that the security team is conducting audit review, analysis, and reporting.
• Represent customer at monthly meetings as needed.
• Coordinate with security engineers to ensure all identified events on the network are audited and analyzed.
• Provide technical expertise in the areas of vulnerability assessment, risk assessment, network security, product evaluation, and security implementation.
• Provide technical evaluations of customer systems and assists with making security improvements.
• Support continuous monitoring of production systems in accordance with defined security controls.
• Participate and contribute to the Configuration Control Board (CCB).
• Manage a team of ISSOs and engineers.

Project Manager – Senior ISSO

Events

• Support end-to-end planning of RAMPCon, including timelines, logistics, and coordination across marketing, sales, and delivery teams
• Assist with vendor coordination, registration management, and attendee communications
• Help build and maintain run-of-show documents and internal trackers to keep everything on schedule
• Update and manage RAMPCon website content (agenda, speakers, event details)
• Ensure accuracy, consistency, and alignment with Coalfire brand standards
• Partner with internal teams to implement updates quickly and efficiently
• Draft and schedule social media content (primarily LinkedIn) to drive event awareness and engagement
• Support email campaign execution, including copy edits and list coordination
• Assist in tracking engagement and performance metrics
• Help manage registration data and campaign lists
• Support reporting on event performance, including registrations and engagement
• Jump in on additional marketing initiatives as needed—this is a team sport

Event Marketing Intern

• Lead Exciting Cloud Projects: Take charge of large-scale cloud engagements, whether starting from scratch (greenfield) or improving existing setups (brownfield).
• Be the Go-To Expert: Provide both subject matter expertise and project management skills, serving as the main point of contact for our engagement teams.
• Ensure Compliance: Design and operate compliance monitoring activities to meet internal security policies and applicable laws.
• Shape Cloud Strategies: Contribute to cloud program management, service delivery models, and strategic planning.
• Create Impactful Reports: Develop and review reports and presentations for both technical and executive audiences.
• Mentor and Grow Talent: Provide mentorship and coaching to help staff enhance their technical and consulting skills.
• Manage Risks and Progress: Keep stakeholders informed about progress and expected outcomes while managing risks effectively.
• Stay Ahead of Trends: Leverage industry knowledge to identify and address engagement and client service issues.
• Collaborate Closely: Work with engagement managers to co-lead and own multiple parts of the engagement delivery.
• Deliver Quality Services: Ensure high-quality work products are delivered within expected timeframes and budgets.
• Engage with Clients: Develop client cloud and security strategies, perform reviews of cloud configurations, and document requirements clearly.
• Design Compliant Solutions: Assist in designing Federal and Defense compliant cloud infrastructure and solutions.
• Advise on Technology Stacks: Provide guidance on AWS, Azure, and GCP platforms.
• Build Relationships: Work with prospective clients to identify opportunities, scope engagements, and build strong relationships.

Senior Consultant, Cloud Services – Core Consulting

• Assume the role of ISSO for information systems and third-party services identified as High Value Assets (HVA) by the agency;
• Perform technical security impact analysis for all changes to the information system;
• Provide the guidance and oversight necessary to ensure the completeness and accuracy of documentation related to the Primary Responsibility or the Supporting Role assigned to the System Owner, Information Owner or Steward;
• Ensure the implementation and maintenance of security controls in accordance with the Security Plan (SP) and Peace Corps policies and procedures;
• Ensure the assigned FISMA systems maintain their ATO through independent security assessment and authorization;
• Review all deliverables and RMF packages for accuracy;
• Have oversight responsibility to ensure proper access controls have been implemented and managed;
• Ensure audit logs are reviewed at an agreed upon frequency, where the frequency may increase if warranted by incident or situational awareness;
• Be responsible for conducting assessments of controls for their system to ensure the controls have been implemented properly and are still effective where the risk posture is documented in a system risk assessment report;
• Ensure documents provided to auditors are what was requested and approved for release;
• Ensure that new vulnerabilities are evaluated by the respective subject matter expert and corrective action implemented;
• Collaborate with the ISSE in conducting security impact assessments on changes to their respective FISMA systems;