Coalfire

General

• Support Coalfire’s contract management, administration, and negotiation process for global revenue transactions
• Assist with overflow procurement transactions
• Review, negotiate, and draft contracts for Coalfire’s products and services in accordance with company guidelines
• Review, draft, and negotiate commercial agreements including MSAs, SOWs, Order Forms, NDAs, subcontractor agreements, teaming agreements, professional services agreements, SaaS and software license agreements, DPAs, BAAs, channel and reseller agreements, government contracts and task orders, and vendor and procurement agreements
• Provide legal support to revenue and procurement contract teams
• Recommend negotiation strategies and techniques to internal business partners
• Support development, enhancement, and execution of contracting policies, guidelines, and exceptions
• Assess contract risk and recommend mitigation approaches
• Support legal and compliance tasks and projects, including updating contract templates and legal forms
• Monitor the legal inbox, triage incoming requests, route matters, and respond to routine inquiries
• Prioritize and execute multiple projects while meeting deadlines and communicating with stakeholders
• Monitor trends and best practices for emerging contracting, legal, and business risks
• Serve as a primary organizational contact during contract negotiations
• Collaborate with the legal team on concepts, techniques, standards, and solutions to complex problems
• Support training for team members and business colleagues on contract management
• Support risk management and litigation initiatives as required
• Travel 10%

Contracts Negotiator, Global Transactions

Cloud Engineer

• Own the technical integrity of Coalfire’s FedRAMP reference architectures and capabilities across AWS, Azure, and GCP, and across certification levels.
• Set the engineering standards delivery teams build against—architecture patterns, security baselines, automation frameworks, and evidence-collection approaches.
• Review and approve custom architecture decisions when client requirements fall outside the standard; promote recurring customizations into the reference architecture so the standard improves every quarter.
• Serve as a technical escalation point for delivery teams on architecture and security design questions to improve client outcomes.
• Keep reference architectures current with evolving FedRAMP requirements, including machine-readable compliance packaging (OSCAL or JSON) and continuous-monitoring mandates.
• Mentor engagement architects and senior engineers; raise the technical bar across the delivery organization.
• Partner with the sales organization on solution shape for the most strategic pursuits.
• Represent Coalfire’s technical point of view in the FedRAMP community—working groups, public comment, and industry forums.

Principal Cloud Engineer

• Own client engagements end-to-end: from contract signature through environment build, control implementation, automated evidence pipelines, and handoff to managed operations.
• Instantiate Coalfire’s reference architecture for the contracted certification level and cloud platform, adapting it to the client’s application and boundary.
• Lead implementation of security controls and the automation that continuously validates them—the evidence a modern FedRAMP certification runs on.
• Coordinate Coalfire’s engineering teams as they deploy their capabilities (identity, monitoring, change management, and more) into your engagement.
• Drive the build through defined quality gates, with a clean, measurable transition to operations—every in-scope control implemented, validated, and stable.
• Serve as the client’s primary technical counterpart: run technical working sessions, manage milestones and risks, and keep scope honest.
• Document architecture decisions and feed lessons from each build back into Coalfire’s standards.

Engagement Architect – Cloud Architecture, FEDRAMP

• Design and implement the security capabilities that satisfy FedRAMP’s Key Security Indicators (KSIs) within your team’s specialty domains.
• Build the Security Decision Record (SDR) automation that deploys those capabilities repeatably across many client environments—infrastructure-as-code, pipelines, and configuration baselines, not one-off builds.
• Develop automated validation and continuous-monitoring evidence for each capability, so the certified state is provable every day.
• Deploy into client environments as the subject-matter expert for your domain: land the capability, integrate it with the client’s stack, troubleshoot, and harden.
• Bring lessons from every deployment back to your team, improving the standard implementation for the next client.
• Mentor junior team members by reviewing their work, sharing best practices, and guiding them through troubleshooting and operational standards.
• Contribute to documentation, runbooks, and machine-readable compliance artifacts.
• Support both new FedRAMP environment builds and the modernization of existing ones.
• Author and peer review detailed design and security documentation, inclusive of vendor best practices.

Cloud Engineer – FEDRAMP

Associate

• Operate, review, or assess implementations of vulnerability scanning tools (Tenable, Qualys, Nexpose, Prisma Cloud, Burp, etc.).
• Provide recommendations on remediating host-based and web application vulnerabilities.
• Conduct manual validation to confirm vulnerability closure.
• Analyze raw scan data to provide reports detailing credential success, inventory validation, and open vulnerabilities.
• Perform analysis to validate justifications provided by clients for vendor dependencies, false positives, operational requirements, and risk adjustments.
• Collaborate with other Coalfire personnel to drive customer satisfaction and ensure timely delivery of vulnerability scan findings, analysis results, and validated justifications.

Associate, Vulnerability Assessment

Technical Writer

• Provide quality control (QC) reviews of customer-facing and internal documents with specific focus on consistency, clarity, and conciseness for at least two verticals
• Ensure that deliverable content follows standard templates, conforms to Coalfire brand guidelines, and is in accordance with Coalfire policies, processes, and guidance
• Enforce consistent use of templates
• Complete QC checks for each client-facing document reviewed
• Identify and log risks and issues for analysis
• Properly store records of work and revisions, including the reviewed document, checklist, and template.

Technical Editor

Security Engineer

• Maintain detailed knowledge and expertise required to manage the security aspects of assigned information systems.
• Ensure that the appropriate operational cybersecurity posture is maintained for assigned systems to provide confidentiality, integrity, and availability of information systems.
• For each system assigned to an ISSO, the ISSO will be responsible to complete and keep updated security documentations, such as SIA, SSP, POA&M, Configuration Management Plan, Vulnerability Reports, etc.
• Participate in planning and management of all phases of the Risk Management Framework (RMF) Security Assessment and Authorization (SAA) process.
• Advise system owners on all matters, technical and otherwise, involving the security of assigned IT systems.
• In coordination with SO team, develop standard operating procedures in accordance with security control requirements.
• Perform continuous monitoring of implemented security controls to ensure that they are implemented correctly, operating as intended and producing the desired outcome with respect to meeting the cybersecurity requirements for assigned IT systems.
• Conduct continuous monitoring activities, to include: Maintenance of current ATO, Conducting periodic system self-assessments, Conducting periodic scans, Conducting log reviews, Ensuring proper sanitization of media prior to disposal.
• Work with technical teams to mitigate security control deficiencies and scan vulnerabilities for assigned IT systems.
• Assess the cybersecurity impact of changes to assigned IT systems and document findings in a security impact analysis (SIA) report.
• Conduct self-assessments of security controls, identify weaknesses and track remediation activities in POA&M.
• Manage the plan of action and milestone (POA&M) process for designated IT systems to provide timely detection, identification and alerting of non-compliance issues.
• In coordination with System Owner staff, create POA&Ms or remediation plans for vulnerabilities identified during risk assessments, audits, inspections, etc.
• Provide the required system access, information, and documentation to security assessment and audit teams.
• Participate in security assessments and audits for assigned systems and facilitate evidence and/or data collection for data requests related to assigned systems.
• Complete required A&A activities on assigned IT systems.
• Brief senior management and ISSM on the security status of assigned authorization boundaries.
• Perform other duties as assigned.

Information Systems Security Officer – Hybrid

Systems Engineer

• Provide services related to the enhancement, expansion, or consolidation of cybersecurity information assurance support
• Support in performing security impact assessments, security testing, and working with operations and development teams on remediation and mitigation of findings
• Provide support to planning, designing and implementing security controls which safeguard and monitor events for information systems, enterprise applications and data
• Provide information system security engineering support to verify and validate proposed architectures and implementations based on sound security engineering principles and practices
• Identify security requirements and provide input to the system design to ensure the proper controls are built-in
• Participate in planning and executing in the system development life cycle of new system cycles
• Conduct risk analysis and update the risk assessment report for all changes to the FISMA systems; and provide a security impact analysis to include but not limited to the change to the overall system risk rating and posture and documentation that is impacted requiring updates

Information System Security Engineer – Hybrid

AI Engineer

• Design, build, and continuously improve a curriculum of AI training programs spanning foundational literacy, role-specific fluency, and advanced practitioner development
• Partner with functional leads across the business to understand skill gaps and tailor learning pathways to specific roles (advisory, delivery, operations, etc.)
• Develop and manage self-paced resources, workshops, certifications, and onboarding materials that scale across a distributed workforce
• Track learning outcomes and adoption metrics, using data to continuously sharpen what's working
• Build and run Coalfire's internal AI community - creating spaces (channels, forums, events, office hours) where employees can share what they're building, ask questions, and learn from each other
• Identify and cultivate internal AI champions and power users across the organization
• Facilitate knowledge-sharing and peer learning so best practices spread organically, not just top-down
• Be the voice that keeps AI top-of-mind internally - translating complex or abstract AI developments into relatable, relevant narratives for a general employee audience
• Develop and distribute internal communications (newsletters, announcements, spotlights) that highlight real AI wins, use cases, and learnings from across the company
• Represent the AI & Data team at all-hands meetings, internal events, and cross-functional forums
• Serve as a thought partner to the Chief AI & Data Officer on the human dimensions of our AI strategy - readiness, culture, change management
• Collaborate with HR and People teams on integrating AI competencies into talent development frameworks, performance expectations, and hiring
• Stay current on enterprise AI trends, tools, and adult learning best practices, bringing relevant insights back to the team

AI Enablement Lead

Compliance

• Lead and support advisory engagements across the Public Sector frameworks
• Maintain strong client relationships throughout the engagement lifecycle
• Provide oversight across compliance frameworks such as FedRAMP, CMMC, DISA Cloud SRG, FISMA, etc.
• Review and develop compliance documentation
• Ensure quality through peer reviews
• Collaborate with internal stakeholders
• Support IT security consulting for cloud and on-premises environments
• Directly manage and mentor 2-3 team members
• Foster client relationships and lead various engagements within the Public sector advisory team
• Build a culture of accountability and excellence while nurturing high-trust partnerships with clients and stakeholders
• Provide advisory consulting support and develop compliance-related reports and documentation
• Ensure quality control through peer reviews of project deliverables
• Partner with sales, quality management, and delivery teams to ensure project timelines and deliverables are met
• Mentor team members in technology, consulting methodologies, technical reviews, and professional writing

Manager, Compliance Advisory

Assessor

• support assessing whether members of the DIB have adequately prepared for compliance with CMMC regulations
• evaluate an organization’s readiness for assessment
• collect and examine evidence
• observe, test and analyze results clearly and effectively
• score OSC practices and validate preliminary results
• generate preliminary report findings
• finalize findings for an assessment report and deliver recommended assessment results

CCA Assessor – CMMC Services

Account Executive

• Develop and drive business development initiatives that align with our current and future cybersecurity portfolio service offerings
• Responsible for creating and executing a quarterly business development plan and process, including coordination of all necessary internal and external resources to identify and secure business opportunities
• Prepare quarterly review on business prospects and market conditions to ensure revenue and resources are aligned with business goals
• Build working relationships cross-functionally with project management team, delivery team, and marketing to ensure coordination of efforts and good communication with all parties
• Establish a repeatable process for deal review, approval, and deal execution
• Support building market awareness internally and externally for our Cybersecurity portfolio service offerings
• Make an impact to Account Management, including account planning, client procurement, meeting follow-up, pipeline development, opportunity pursuit, contract negotiation, risk management, proposal and Statement of Work (SOW) development, and revenue goals
• Engage with clients in strategic discussions to provide best in class Cybersecurity / IT Strategy and industry guidance to maximize client’s long-term business objectives.
• Develop strong and lasting relationships with client executives, effectively engage new business and position the account for follow on security and risk advisory engagements.
• Develop and maintain contact with top decision makers at key clients; organize and lead pursuit teams; participate and lead aspects of the proposal development process; contribute to the development of proposal pricing strategies.
• Lead client-facing management Security Strategy and Planning sessions and formal proposal presentations.
• Maintain customer strategy and direction while collaborating with internal teams, leveraging sales tools such as Salesforce.
• Contribute to problem-solving sessions with the project team, consulting team, and client representatives on a regular basis.
• Develop business with new buyers and business units within existing accounts.
• Marketing Qualified Lead management from origination of lead through lead qualification to lead conversion to new opportunity

Account Executive – AI, Cloud, Compliance Advisory

• Work with team members in assessing whether members of the DIB have adequately prepared for compliance with CMMC regulations
• Participate in the team that will evaluate an organization’s readiness for assessment, which include the support and capability for tasks such as: collect and examine evidence, observe, test and analyze results, clearly and effectively score OSC practices, validate preliminary results, generate preliminary report findings, finalize findings for an assessment report and deliver recommended assessment results
• Ability to work independently and as a part of a team
• Professional and polished interpersonal and communication skills with team members and stakeholders

CMMC Certified Assessor, CCP

Manager

• Support the lifecycle management of cybersecurity and compliance offerings, including ideation, design, refresh, packaging, launch, enablement, sustainment, and retirement activities.
• Partner with offering leadership, practice leaders, and solution stakeholders to standardize services into repeatable components, tiers, variations, and SKU-ready structures that improve scalability and consistency.
• Own day-to-day coordination of offering initiatives, including intake tracking, status reporting, meeting preparation, follow-up actions, and documentation of decisions across offering governance forums and portfolio workstreams.
• Create and maintain go-to-market sales collateral, including proposal materials, datasheets, whitepapers, standard presentations, catalogs, and other enablement content that clearly articulates Coalfire's value to clients and the field.
• Perform competitive analysis and pricing support for Coalfire offerings to inform packaging, list pricing, margin targets, and growth strategies for enterprise-level clients.
• Support pre-sales activities, including client meetings, solutioning discussions, and cross-functional RFP responses, ensuring offerings are positioned clearly and scoped consistently.
• Stay current with emerging security threats, industry trends, and client demand patterns, and proactively recommend updates to offerings, messaging, and portfolio priorities.
• Partner with senior leadership and cross-functional teams to improve scoping, quoting, and contracting workflows, including cost case optimization, standard scope definitions, and SOW content inputs.
• Support the development of new threat-focused services, including initial research, offering design, pricing inputs, staffing assumptions, collateral development, partner coordination, and internal enablement.

Senior Offering Manager

Revenue Operations

• Own the MQL to opportunity handoff process — ensuring leads are routed correctly, followed up on promptly, and that no lead goes unactioned.
• Partner with marketing to define and maintain lead quality standards, MQL definitions, and conversion benchmarks; hold both sides accountable to agreed service levels.
• Monitor pipeline generation against targets on a weekly basis; identify gaps and hold teams accountable to commitments.
• Serve as the primary point of escalation when pipeline generation is at risk — proactively surfacing issues to Sales Leadership before they become forecast problems.
• Partner with the Director, Forecasting & Revenue Analytics to ensure top-of-funnel metrics connect to pipeline and bookings forecasts.
• Coordinate across marketing, offering management, and delivery to ensure the field has the tools and content needed to execute — including pricing, bid sheets, scoping tables, proposal templates, and value messaging.
• Own the relationship with Coalfire’s outsourced SDR vendor — including performance management, target setting, activity alignment, and contract oversight.
• Own and maintain Coalfire’s master GTM calendar — coordinating activity across marketing campaigns, events, offering launches, partner programs, SDR plays, AE activity, and training.
• Travel as required by leadership — generally less than 20%