GRC Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a GRC Engineer – GOV (FedRAMP 20x) based in the United States.

Join a fast-growing cybersecurity and compliance environment helping organizations strengthen their security posture and meet demanding federal requirements. In this hands-on role, you will support government compliance initiatives by translating regulatory standards into practical, technology-driven solutions. You will contribute to FedRAMP 20x certification efforts, automated evidence collection, and continuous security monitoring. Working closely with client engineering teams, compliance professionals, and independent assessors, you will help organizations identify and remediate security gaps. You will use tools and technologies such as OSCAL, JSON, YAML, cloud security platforms, and policy-as-code solutions to improve compliance efficiency. This opportunity offers close collaboration with experienced practitioners, ongoing mentorship, and exposure to evolving federal cybersecurity frameworks.

• FedRAMP 20x Compliance Execution: Analyze and apply FedRAMP Consolidated Rules (CR26) and the 46 Key Security Indicators (KSIs) across 10 control families to help ensure that software architectures meet applicable federal security requirements.
• Machine-Readable Compliance Documentation: Create, update, and maintain technical certification artifacts, including Security Decision Records, Security Configuration Guides, and OSCAL-based documentation using JSON and YAML in accordance with applicable technical specifications and federal guidance.
• Automated Evidence Collection: Build, implement, and maintain automated evidence pipelines that continuously validate security controls and KSIs, reducing reliance on manual, point-in-time audit processes.
• Readiness and Gap Assessments: Conduct technical readiness reviews, map security controls, and assess compliance against FedRAMP 20x Class A, Class B, and Class C baseline requirements.
• Continuous Security Monitoring: Support Collaborative Continuous Monitoring (CCM) initiatives by integrating cloud security posture management (CSPM) and governance, risk, and compliance (GRC) tools into monitoring workflows that provide ongoing security validation.
• Third-Party Assessment Support: Coordinate evidence collection, documentation submissions, and assessment logistics for Third-Party Assessment Organization (3PAO) audits and independent security assessments under senior team guidance.
• Security Remediation: Collaborate with client and internal technical teams to investigate compliance deficiencies and implement remediation measures across cloud and multi-cloud environments.
• Regulatory Monitoring: Track changes to CR26 requirements, Significant Change Notifications (SCNs), and the transition from FedRAMP Rev. 5 to FedRAMP 20x to help maintain alignment with evolving federal standards.
• Client Collaboration: Work directly with client engineering and compliance stakeholders to communicate findings, coordinate deliverables, and ensure progress across multiple compliance workstreams.
• Project and Delivery Management: Manage concurrent technical tasks, maintain accurate documentation, meet deadlines, and escalate risks or blockers promptly while working under senior guidance.

• Professional Experience: At least 2 years of direct technical experience delivering governance, risk, and compliance (GRC) work involving NIST SP 800-53, FedRAMP, or federal security authorization programs.
• FedRAMP 20x Knowledge: Foundational understanding of the FedRAMP 20x certification model, Class A/B/C classifications, CR26 rules, and KSI-based security validation.
• Technical Documentation: Practical experience creating or maintaining machine-readable compliance artifacts using OSCAL, JSON, YAML, or comparable structured documentation formats.
• Cloud Security Expertise: Familiarity with cloud infrastructure platforms such as AWS, Microsoft Azure, or Google Cloud Platform, ideally including government cloud environments such as AWS GovCloud or Azure Government.
• Compliance Automation: Working knowledge of scripting or policy-as-code technologies, including Python, Rego/OPA, or Terraform, with the ability to contribute to automated evidence collection and control validation.
• Security and Compliance Fundamentals: Understanding of security controls, risk assessment, remediation processes, technical evidence gathering, and federal authorization requirements.