Information Systems Security Engineer
Summary
Owns the security documentation and authorization package for Snowflake's classified deployments for US government customers, starting with Arc Reactor. Leads NIST 800-53/RMF and FedRAMP control assessments, directs engineers producing control evidence, and reports authorization status and risk to the program from the Washington, DC area.
At Snowflake, we are powering the era of the agentic enterprise. To usher in this new era, we seek AI-native thinkers across every function who are energized by the opportunity to reinvent how they work. You don’t just use tools; you possess an innate curiosity, treating AI as a high-trust collaborator that is core to how you solve problems and accelerate your impact. We look for low-ego individuals who thrive in dynamic and fast-moving environments and move with an experimental mindset — who rapidly test emerging capabilities to discover simpler, more powerful ways to deliver results. At Snowflake, your role isn't just to execute a function, but to help redefine the future of how work gets done.
Information Systems Security Engineer (Principal)
About the role
Snowflake's national security deployments are authorized to operate inside classified environments, and each authorization stands or falls on the security documentation behind it. This role owns that documentation. You assess the system against its security control baseline, assemble the evidence the authorizing official reviews, and you are accountable for the package getting to authorization on schedule.
Arc Reactor, a classified deployment for a US government customer, is the immediate assignment. The same work will apply to the deployments that follow it.
What you will do
Lead the security control assessment for an assigned deployment, from control selection and tailoring through the body of evidence to authorization.
Produce the assessment plan, the evidence collection schedule and the residual risk that goes to the authorizing official, and keep them current.
Direct the engineers and security staff producing control artifacts. Tell them which evidence to collect, review what they produce, and catch gaps in the requirements before they surface during assessment.
Be the person who can explain a Snowflake control implementation to a government security reviewer, and explain a reviewer's finding back to the engineering team in terms they can act on.
Track authorization status and blockers, and report them weekly to the engineering lead and the program.
What you bring
You have taken at least one system through authorization to operate under a government security control framework (NIST 800-53 / RMF, FedRAMP, or the DoD RMF and its Impact Levels), and you can point to the package you were responsible for.
You can read an engineering implementation and decide which control it satisfies and what evidence it produces.
You have worked with government authorizing officials or security control assessors, and you know what they reject and why.
You write the plan down. Assessment scope, control status, evidence gaps and residual risk live in a document the team can run without you, not in your head.
You are eligible for TS/SCI with a full-scope polygraph, or already hold it.
How this team works
The ISSE does not work alone and does not do all the collection. Engineers and supporting security staff produce the artifacts; you decide what is needed, review it, and own the result. The role reports into national security engineering and sits in the deployment's weekly engineering and security cadence. The work is done from the Washington, DC area, with regular time on site.
Snowflake is growing fast, and we’re scaling our team to help enable and accelerate our growth. We are looking for people who share our values, challenge ordinary thinking, and push the pace of innovation while building a future for themselves and Snowflake.
How do you want to make your impact?
For jobs located in the United States, please visit the job posting on the Snowflake Careers Site for salary and benefits information:
Skills
As published by ashby · 13 questions
Basics
Full Name, Email, Resume, Location
Short answers (3)
- Phone Number
- LinkedIn Profile, if available optional
- Where have you most recently worked?
Pick from a list (9)
- Will you require company sponsorship now or in the future to maintain or extend your current work authorization status?
- In office attendance is an essential function for this role and necessary to enable effective teamwork and collaboration. Do you currently reside within commuting distance or are you open to relocation to the local Snowflake office(s) designated in this post?
- Have you worked at Snowflake in the past in a Full-time, Part-time, contractor or Intern capacity?
- For Snowflake to anticipate possible immigration timelines and obligations, could you confirm you are currently authorized to work in the country to which you are applying?
- A “U.S. person” is a citizen, legal permanent resident, or legal temporary resident (i.e., a refugee or asylee) of the United States. Which of the following best describes your “U.S. person” status?
- Due to SEC auditor independence requirements, please let us know whether you have previously worked at, or if currently working at PricewaterhouseCoopers (PwC), who is our independent auditor.
- Have you ever been directly employed by (1) any government or military entity, state-owned enterprise, or publicly-funded institution, or (2) a government contractor in a role that recommended Snowflake as part of Government procurement?
- In any materials you submit, you may redact or remove age-identifying information such as age, date of birth, or dates of school attendance or graduation. You will not be penalized for redacting or removing this information.
- Snowflake will process your personal information in accordance with the Snowflake Candidate Privacy Notice.
Attachments (1)
- Additional Attachments optional