GRC Engineer - GOV (FedRAMP 20x)

Accountabilities: FedRAMP 20x Compliance Execution: Analyze and apply FedRAMP Consolidated Rules (CR26) and the 46 Key Security Indicators (KSIs) across 10 control families to help ensure that software architectures meet applicable federal security requirements. Machine-Readable Compliance Documentation: Create, update, and maintain technical certification artifacts, including Security Decision Records, Security Configuration Guides, and OSCAL-based documentation using JSON and YAML in accordance with applicable technical specifications and federal guidance. Automated Evidence Collection: Build, implement, and maintain automated evidence pipelines that continuously validate security controls and KSIs, reducing reliance on manual, point-in-time audit processes. Readiness and Gap Assessments: Conduct technical readiness reviews, map security controls, and assess compliance against FedRAMP 20x Class A, Class B, and Class C baseline requirements. Continuous Security Monitoring: Support Collaborative Continuous Monitoring (CCM) initiatives by integrating cloud security posture management (CSPM) and governance, risk, and compliance (GRC) tools into monitoring workflows that provide ongoing security validation. Third-Party Assessment Support: Coordinate evidence collection, documentation submissions, and assessment logistics for Third-Party Assessment Organization (3PAO) audits and independent security assessments under senior team guidance. Security Remediation: Collaborate with client and internal technical teams to investigate compliance deficiencies and implement remediation measures across cloud and multi-cloud environments. Regulatory Monitoring: Track changes to CR26 requirements, Significant Change Notifications (SCNs), and the transition from FedRAMP Rev. 5 to FedRAMP 20x to help maintain alignment with evolving federal standards. Client Collaboration: Work directly with client engineering and compliance stakeholders to communicate findings, coordinate deliverables, and ensure progress across multiple compliance workstreams. Project and Delivery Management: Manage concurrent technical tasks, maintain accurate documentation, meet deadlines, and escalate risks or blockers promptly while working under senior guidance. Requirements Professional Experience: At least 2 years of direct technical experience delivering governance, risk, and compliance (GRC) work involving NIST SP 800-53, FedRAMP, or federal security authorization programs. FedRAMP 20x Knowledge: Foundational understanding of the FedRAMP 20x certification model, Class A/B/C classifications, CR26 rules, and KSI-based security validation. Technical Documentation: Practical experience creating or maintaining machine-readable compliance artifacts using OSCAL, JSON, YAML, or comparable structured documentation formats. Cloud Security Expertise: Familiarity with cloud infrastructure platforms such as AWS, Microsoft Azure, or Google Cloud Platform, ideally including government cloud environments such as AWS GovCloud or Azure Government. Compliance Automation: Working knowledge of scripting or policy-as-code technologies, including Python, Rego/OPA, or Terraform, with the ability to contribute to automated evidence collection and control validation. Security and Compliance Fundamentals: Understanding of security controls, risk assessment, remediation processes, technical evidence gathering, and federal authorization requirements. Analytical and Organizational Skills: Strong attention to detail, effective problem-solving abilities, and the capacity to manage multiple compliance deliverables simultaneously while maintaining accuracy and quality. Communication Skills: Excellent written and verbal English communication skills, with the ability to collaborate professionally with client engineering teams, compliance stakeholders, and external assessors. Preferred Security Certifications: CompTIA Security+, Certified in Governance, Risk and Compliance (CGRC), Certified Authorization Professional (CAP), or Associate of CISSP credentials are advantageous. Preferred Cloud Certifications: AWS Solutions Architect – Associate, Azure Security Engineer Associate, Google Cloud Associate Cloud Engineer, or comparable technical certifications are beneficial. Preferred Assessment Experience: Previous involvement in 3PAO audits, agency Authority to Operate (ATO) evaluations, FedRAMP continuous monitoring, or Collaborative Continuous Monitoring workflows is a plus. Additional Framework Knowledge: Familiarity with CMMC 2.0 and NIST SP 800-171 requirements, particularly in defense supply chain environments, is desirable. Remote Work Readiness: Ability to work remotely with a reliable, high-speed internet connection and a professional home office suitable for confidential discussions and uninterrupted collaboration. Working Hours and Travel: Availability to work a standard schedule of 8:00 AM to 5:00 PM U.S. Eastern Time, with occasional flexibility to accommodate business needs, and willingness to travel locally for occasional in-person meetings or team activities. Work Authorization: Must be legally authorized to work in the United States without current or future employer-sponsored visa support or transfer. Benefits Competitive Compensation: Competitive base salary, regular performance reviews, merit-based compensation adjustments, and bonus opportunities. Career Development: Opportunities for professional growth within a fast-growing organization, with a clear path for career advancement. Training and Certifications: Reimbursement for approved training programs and professional certification courses relevant to the role. Mentorship: Opportunities to learn from experienced cybersecurity and GRC practitioners while developing specialized expertise in federal compliance and security automation. Remote-First Flexibility: Work remotely from the United States while collaborating with a global team. Technical Exposure: Hands-on experience with FedRAMP 20x, automated compliance workflows, cloud security environments, and emerging compliance-as-code practices. Collaborative Environment: Work alongside a supportive team that values technical excellence, continuous learning, clear communication, and high-quality client delivery. Meaningful Impact: Contribute to strengthening cybersecurity and compliance across government organizations, federal service providers, and defense-related environments.