GRC Engineer - GOV (FedRAMP 20x)

Join a fast-growing cybersecurity and compliance environment helping organizations strengthen their security posture and meet demanding federal requirements. In this hands-on role, you will support government compliance initiatives by translating regulatory standards into practical, technology-driven solutions. You will contribute to FedRAMP 20x certification efforts, automated evidence collection, and continuous security monitoring. Working closely with client engineering teams, compliance professionals, and independent assessors, you will help organizations identify and remediate security gaps. You will use tools and technologies such as OSCAL, JSON, YAML, cloud security platforms, and policy-as-code solutions to improve compliance efficiency. This opportunity offers close collaboration with experienced practitioners, ongoing mentorship, and exposure to evolving federal cybersecurity frameworks. If you are detail-oriented, technically curious, and passionate about security automation, this role offers an opportunity to make a meaningful impact on the security of government and defense-related systems.

• Professional Experience: At least 2 years of direct technical experience delivering governance, risk, and compliance (GRC) work involving NIST SP 800-53, FedRAMP, or federal security authorization programs.

• FedRAMP 20x Knowledge: Foundational understanding of the FedRAMP 20x certification model, Class A/B/C classifications, CR26 rules, and KSI-based security validation.

• Technical Documentation: Practical experience creating or maintaining machine-readable compliance artifacts using OSCAL, JSON, YAML, or comparable structured documentation formats.

• Cloud Security Expertise: Familiarity with cloud infrastructure platforms such as AWS, Microsoft Azure, or Google Cloud Platform, ideally including government cloud environments such as AWS GovCloud or Azure Government.

• Compliance Automation: Working knowledge of scripting or policy-as-code technologies, including Python, Rego/OPA, or Terraform, with the ability to contribute to automated evidence collection and control validation.

• Security and Compliance Fundamentals: Understanding of security controls, risk assessment, remediation processes, technical evidence gathering, and federal authorization requirements.

• Analytical and Organizational Skills: Strong attention to detail, effective problem-solving abilities, and the capacity to manage multiple compliance deliverables simultaneously while maintaining accuracy and quality.

• Communication Skills: Excellent written and verbal English communication skills, with the ability to collaborate professionally with client engineering teams, compliance stakeholders, and external assessors.

• Preferred Security Certifications: CompTIA Security+, Certified in Governance, Risk and Compliance (CGRC), Certified Authorization Professional (CAP), or Associate of CISSP credentials are advantageous.

• Preferred Cloud Certifications: AWS Solutions Architect – Associate, Azure Security Engineer Associate, Google Cloud Associate Cloud Engineer, or comparable technical certifications are beneficial.

• Preferred Assessment Experience: Previous involvement in 3PAO audits, agency Authority to Operate (ATO) evaluations, FedRAMP continuous monitoring, or Collaborative Continuous Monitoring workflows is a plus.

• Additional Framework Knowledge: Familiarity with CMMC 2.0 and NIST SP 800-171 requirements, particularly in defense supply chain environments, is desirable.

• Remote Work Readiness: Ability to work remotely with a reliable, high-speed internet connection and a professional home office suitable for confidential discussions and uninterrupted collaboration.

• Working Hours and Travel: Availability to work a standard schedule of 8:00 AM to 5:00 PM U.S. Eastern Time, with occasional flexibility to accommodate business needs, and willingness to travel locally for occasional in-person meetings or team activities.

• Work Authorization: Must be legally authorized to work in the United States without current or future employer-sponsored visa support or transfer.