GRC Engineer (CMMC)

Summary

Workstreet helps businesses scale securely by designing and implementing governance, risk, and compliance programs across frameworks including FedRAMP, CMMC, and NIST. The GRC Engineer will guide SaaS providers and federal contractors through federal authorization lifecycles, conduct readiness assessments and gap analyses, develop compliance artifacts, support continuous monitoring, and advise on CMMC and NIST requirements.

Responsibilities

• Analyze and apply NIST SP 800-53 controls and FedRAMP Moderate and High baselines to ensure client software architectures align with federal agency requirements
• Author and update core federal authorization artifacts, including System Security Plans (SSPs), control implementation narratives, POA&Ms, SAPs, and SARs
• Perform detailed readiness assessments and gap analyses to prepare client environments for Joint Authorization Board (JAB) or Agency ATO validation paths
• Architect technical authorization boundaries and scoping profiles across FedRAMP and CMMC environments, mapping data flows, interconnectivity, and shared responsibility models
• Execute continuous monitoring (ConMon) cycles, actively tracking monthly vulnerability management logs, incident response reports, and structural change control workflows
• Coordinate external assessment pipelines, facilitating critical operational alignment between clients, Cloud Service Providers (CSPs), 3PAOs, and federal stakeholders
• Advise defense contractor clients on CMMC 2.0 and NIST SP 800-171 controls, translating dense regulatory language into practical, actionable security milestones
• Formulate highly structured compliance documentation specifically required for CMMC Level 1 and Level 2 assessment readiness

Skills

• * **Proven federal compliance analyst** - Bring 2+ years of direct execution in GRC roles with active exposure driving FedRAMP, NIST SP 800-53, and federal authorization lifecycles
• * **Federal documentation practitioner** - Hands-on experience authoring, evaluating, and maintaining key federal artifacts, explicitly including System Security Plans (SSPs) and Plans of Action and Milestones (POA&Ms)
• * **CMMC and NIST framework generalist** - Grounded in the structural requirements of CMMC 2.0 and NIST SP 800-171 baselines as they apply to defense contractors and supply chain data
• * **Sovereign cloud environment navigator** - Familiar with the shared responsibility models, operational constraints, and secure configurations of government clouds like AWS GovCloud, Azure Government, or Microsoft GCC High
• * **Disciplined portfolio coordinator** - Command strong project management mechanics to support multiple fast-moving client compliance initiatives simultaneously while preserving documentation quality
• * **Regulated technology consultant** - Experienced partnering with B2B SaaS providers, federal contractors, or regulated tech companies to systematically navigate federal security baselines
• * **High-velocity startup operator** - Excel within fluid consulting or fast-growth startup environments, demonstrating the agility to adapt to shifting client demands and assert immediate task ownership
• * Excellent written and verbal English communication skills, with the ability to engage confidently with candidates, hiring managers, and business leaders across global teams
• * A reliable, high-speed internet connection and a professional home office environment that supports confidential conversations, virtual interviews, and uninterrupted collaboration
• * Commitment to working a standard schedule of 8:00 AM–5:00 PM US Eastern Time (ET) to effectively support hiring managers, candidates, and cross-functional teams. Occasional flexibility to adjust working hours is expected to accommodate changing business priorities, global collaboration, and time-sensitive hiring needs
• * Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities as needed
• * Applicants must be authorized to work in the U.S. without the need for visa sponsorship now or in the future. Workstreet does not provide employment-based visa sponsorship or transfers for this role, including H-1B, L-1, TN, O-1, E-3, H-1B1, F-1 (OPT/CPT), J-1, or any other work-authorized visa category
• * **Direct JAB or Agency ATO execution** - Direct history supporting live Joint Authorization Board or federal agency Authority to Operate (ATO) certification tracks
• * **Credentialed compliance professional** - Hold industry-specific defense designations such as CMMC Registered Practitioner (RP), Certified Professional (CCP), or Certified Assessor (CCA)
• * **Validated information security markers** - Active certification through recognized professional bodies, explicitly holding a CISSP, CISM, or CompTIA Security+
• * **Command of DFARS and CUI data lifecycles** - Strong foundational knowledge of Controlled Unclassified Information (CUI) protections, DFARS regulatory clauses, and SPRS submission workflows
• * **Collaborative assessment history** - Prior success working directly side-by-side with 3PAO or C3PAO independent examination teams

Qualifications

Must Haves

• * **Proven federal compliance analyst** - Bring 2+ years of direct execution in GRC roles with active exposure driving FedRAMP, NIST SP 800-53, and federal authorization lifecycles
• * **Federal documentation practitioner** - Hands-on experience authoring, evaluating, and maintaining key federal artifacts, explicitly including System Security Plans (SSPs) and Plans of Action and Milestones (POA&Ms)
• * **CMMC and NIST framework generalist** - Grounded in the structural requirements of CMMC 2.0 and NIST SP 800-171 baselines as they apply to defense contractors and supply chain data
• * **Sovereign cloud environment navigator** - Familiar with the shared responsibility models, operational constraints, and secure configurations of government clouds like AWS GovCloud, Azure Government, or Microsoft GCC High
• * **Disciplined portfolio coordinator** - Command strong project management mechanics to support multiple fast-moving client compliance initiatives simultaneously while preserving documentation quality
• * **Regulated technology consultant** - Experienced partnering with B2B SaaS providers, federal contractors, or regulated tech companies to systematically navigate federal security baselines
• * **High-velocity startup operator** - Excel within fluid consulting or fast-growth startup environments, demonstrating the agility to adapt to shifting client demands and assert immediate task ownership
• * Excellent written and verbal English communication skills, with the ability to engage confidently with candidates, hiring managers, and business leaders across global teams
• * A reliable, high-speed internet connection and a professional home office environment that supports confidential conversations, virtual interviews, and uninterrupted collaboration
• * Commitment to working a standard schedule of 8:00 AM–5:00 PM US Eastern Time (ET) to effectively support hiring managers, candidates, and cross-functional teams. Occasional flexibility to adjust working hours is expected to accommodate changing business priorities, global collaboration, and time-sensitive hiring needs
• * Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities as needed
• * Applicants must be authorized to work in the U.S. without the need for visa sponsorship now or in the future. Workstreet does not provide employment-based visa sponsorship or transfers for this role, including H-1B, L-1, TN, O-1, E-3, H-1B1, F-1 (OPT/CPT), J-1, or any other work-authorized visa category

Nice to Haves

• * **Direct JAB or Agency ATO execution** - Direct history supporting live Joint Authorization Board or federal agency Authority to Operate (ATO) certification tracks
• * **Credentialed compliance professional** - Hold industry-specific defense designations such as CMMC Registered Practitioner (RP), Certified Professional (CCP), or Certified Assessor (CCA)
• * **Validated information security markers** - Active certification through recognized professional bodies, explicitly holding a CISSP, CISM, or CompTIA Security+
• * **Command of DFARS and CUI data lifecycles** - Strong foundational knowledge of Controlled Unclassified Information (CUI) protections, DFARS regulatory clauses, and SPRS submission workflows
• * **Collaborative assessment history** - Prior success working directly side-by-side with 3PAO or C3PAO independent examination teams

Benefits

• Clear path with mentorship and training opportunities.
• Reimbursement for the successful completion of approved training and certification courses relevant to your current role.
• A competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities.
• Significant room for career advancement.
• Flexibility to work from anywhere while collaborating with a global team.