GRC Engineer - GOV (FedRAMP 20x)
- Work arrangement
- Remote
- Occupation
- Software & IT
- Location
- US
- Compensation
- Not disclosed
- Apply by
- April 13, 2027
About this role
Accountabilities
FedRAMP20xComplianceExecution:AnalyzeandapplyFedRAMPConsolidatedRules(CR26)andthe46KeySecurityIndicators(KSIs)across10controlfamiliestohelpensurethatsoftwarearchitecturesmeetapplicablefederalsecurityrequirements.
Machine-ReadableComplianceDocumentation:Create,update,andmaintaintechnicalcertificationartifacts,includingSecurityDecisionRecords,SecurityConfigurationGuides,andOSCAL-baseddocumentationusingJSONandYAMLinaccordancewithapplicabletechnicalspecificationsandfederalguidance.
AutomatedEvidenceCollection:Build,implement,andmaintainautomatedevidencepipelinesthatcontinuouslyvalidatesecuritycontrolsandKSIs,reducingrelianceonmanual,point-in-timeauditprocesses.
ReadinessandGapAssessments:Conducttechnicalreadinessreviews,mapsecuritycontrols,andassesscomplianceagainstFedRAMP20xClassA,ClassB,andClassCbaselinerequirements.
ContinuousSecurityMonitoring:SupportCollaborativeContinuousMonitoring(CCM)initiativesbyintegratingcloudsecurityposturemanagement(CSPM)andgovernance,risk,andcompliance(GRC)toolsintomonitoringworkflowsthatprovideongoingsecurityvalidation.
Third-PartyAssessmentSupport:Coordinateevidencecollection,documentationsubmissions,andassessmentlogisticsforThird-PartyAssessmentOrganization(3PAO)auditsandindependentsecurityassessmentsunderseniorteamguidance.
SecurityRemediation:Collaboratewithclientandinternaltechnicalteamstoinvestigatecompliancedeficienciesandimplementremediationmeasuresacrosscloudandmulti-cloudenvironments.
RegulatoryMonitoring:TrackchangestoCR26requirements,SignificantChangeNotifications(SCNs),andthetransitionfromFedRAMPRev.5toFedRAMP20xtohelpmaintainalignmentwithevolvingfederalstandards.
ClientCollaboration:Workdirectlywithclientengineeringandcompliancestakeholderstocommunicatefindings,coordinatedeliverables,andensureprogressacrossmultiplecomplianceworkstreams.
ProjectandDeliveryManagement:Manageconcurrenttechnicaltasks,maintainaccuratedocumentation,meetdeadlines,andescalaterisksorblockerspromptlywhileworkingunderseniorguidance.
ProfessionalExperience:Atleast2yearsofdirecttechnicalexperiencedeliveringgovernance,risk,andcompliance(GRC)workinvolvingNISTSP800-53,FedRAMP,orfederalsecurityauthorizationprograms.
FedRAMP20xKnowledge:FoundationalunderstandingoftheFedRAMP20xcertificationmodel,ClassA/B/Cclassifications,CR26rules,andKSI-basedsecurityvalidation.
TechnicalDocumentation:Practicalexperiencecreatingormaintainingmachine-readablecomplianceartifactsusingOSCAL,JSON,YAML,orcomparablestructureddocumentationformats.
CloudSecurityExpertise:FamiliaritywithcloudinfrastructureplatformssuchasAWS,MicrosoftAzure,orGoogleCloudPlatform,ideallyincludinggovernmentcloudenvironmentssuchasAWSGovCloudorAzureGovernment.
ComplianceAutomation:Workingknowledgeofscriptingorpolicy-as-codetechnologies,includingPython,Rego/OPA,orTerraform,withtheabilitytocontributetoautomatedevidencecollectionandcontrolvalidation.
SecurityandComplianceFundamentals:Understandingofsecuritycontrols,riskassessment,remediationprocesses,technicalevidencegathering,andfederalauthorizationrequirements.
AnalyticalandOrganizationalSkills:Strongattentiontodetail,effectiveproblem-solvingabilities,andthecapacitytomanagemultiplecompliancedeliverablessimultaneouslywhilemaintainingaccuracyandquality.
CommunicationSkills:ExcellentwrittenandverbalEnglishcommunicationskills,withtheabilitytocollaborateprofessionallywithclientengineeringteams,compliancestakeholders,andexternalassessors.
PreferredSecurityCertifications:CompTIASecurity+,CertifiedinGovernance,RiskandCompliance(CGRC),CertifiedAuthorizationProfessional(CAP),orAssociateofCISSPcredentialsareadvantageous.
PreferredCloudCertifications:AWSSolutionsArchitect–Associate,AzureSecurityEngineerAssociate,GoogleCloudAssociateCloudEngineer,orcomparabletechnicalcertificationsarebeneficial.
PreferredAssessmentExperience:Previousinvolvementin3PAOaudits,agencyAuthoritytoOperate(ATO)evaluations,FedRAMPcontinuousmonitoring,orCollaborativeContinuousMonitoringworkflowsisaplus.
AdditionalFrameworkKnowledge:FamiliaritywithCMMC2.0andNISTSP800-171requirements,particularlyindefensesupplychainenvironments,isdesirable.
RemoteWorkReadiness:Abilitytoworkremotelywithareliable,high-speedinternetconnectionandaprofessionalhomeofficesuitableforconfidentialdiscussionsanduninterruptedcollaboration.
WorkingHoursandTravel:Availabilitytoworkastandardscheduleof8:00AMto5:00PMU.S.EasternTime,withoccasionalflexibilitytoaccommodatebusinessneeds,andwillingnesstotravellocallyforoccasionalin-personmeetingsorteamactivities.
WorkAuthorization:MustbelegallyauthorizedtoworkintheUnitedStateswithoutcurrentorfutureemployer-sponsoredvisasupportortransfer.
CompetitiveCompensation:Competitivebasesalary,regularperformancereviews,merit-basedcompensationadjustments,andbonusopportunities.
CareerDevelopment:Opportunitiesforprofessionalgrowthwithinafast-growingorganization,withaclearpathforcareeradvancement.
TrainingandCertifications:Reimbursementforapprovedtrainingprogramsandprofessionalcertificationcoursesrelevanttotherole.
Mentorship:OpportunitiestolearnfromexperiencedcybersecurityandGRCpractitionerswhiledevelopingspecializedexpertiseinfederalcomplianceandsecurityautomation.
Remote-FirstFlexibility:WorkremotelyfromtheUnitedStateswhilecollaboratingwithaglobalteam.
TechnicalExposure:Hands-onexperiencewithFedRAMP20x,automatedcomplianceworkflows,cloudsecurityenvironments,andemergingcompliance-as-codepractices.
CollaborativeEnvironment:Workalongsideasupportiveteamthatvaluestechnicalexcellence,continuouslearning,clearcommunication,andhigh-qualityclientdelivery.
MeaningfulImpact:Contributetostrengtheningcybersecurityandcomplianceacrossgovernmentorganizations,federalserviceproviders,anddefense-relatedenvironments.