GRC Engineer (CMMC)

Accountabilities:

• Analyze and apply NIST SP 800-53 controls and FedRAMP Moderate and High baselines to assess client architectures against federal security requirements.
• Advise defense contractor clients on CMMC 2.0 and NIST SP 800-171 requirements, translating regulatory expectations into practical and actionable security milestones.
• Author, maintain, and evaluate key compliance and authorization artifacts, including System Security Plans (SSPs), control implementation narratives, Plans of Action and Milestones (POA&Ms), Security Assessment Plans (SAPs), and Security Assessment Reports (SARs).
• Conduct detailed readiness assessments and gap analyses to prepare clients for federal Authority to Operate (ATO), Joint Authorization Board (JAB), and CMMC assessment pathways.
• Define and document technical authorization boundaries, data flows, interconnectivity, and shared-responsibility models across FedRAMP and CMMC environments.
• Execute continuous monitoring activities, including vulnerability management tracking, incident response documentation, structural change workflows, and recurring compliance updates.
• Coordinate external assessment activities between clients, Cloud Service Providers, 3PAOs, C3PAOs, and relevant federal stakeholders.
• Develop structured compliance documentation and assessment-readiness materials for CMMC Level 1 and Level 2 engagements.
• Manage multiple client compliance initiatives simultaneously while maintaining strong documentation quality, deadlines, and delivery standards.
• Serve as a trusted client advisor, communicating complex security and compliance concepts clearly and helping stakeholders navigate evolving requirements.
• Stay current with changes to federal cybersecurity frameworks, regulatory requirements, cloud security practices, and defense compliance standards.

Requirements:

• 2+ years of direct experience in GRC, cybersecurity compliance, or related roles with hands-on exposure to FedRAMP, NIST SP 800-53, NIST SP 800-171, or federal authorization lifecycles.
• Practical experience authoring, evaluating, and maintaining federal compliance artifacts, particularly SSPs and POA&Ms.
• Foundational knowledge of CMMC 2.0 and NIST SP 800-171 requirements as they apply to defense contractors and Controlled Unclassified Information (CUI).
• Familiarity with DFARS requirements and CUI protection practices is strongly valued.
• Experience working with government cloud environments such as AWS GovCloud, Azure Government, or Microsoft GCC High.
• Understanding of cloud shared-responsibility models, technical security boundaries, data flows, and secure configurations.
• Experience supporting B2B SaaS providers, federal contractors, regulated technology organizations, or comparable clients.
• Strong project management and organizational skills, with the ability to manage several fast-moving compliance initiatives while maintaining attention to detail.
• Excellent written and verbal English communication skills, with confidence engaging directly with technical teams, clients, assessors, and other stakeholders.
• Ability to translate complex regulatory and technical requirements into clear, actionable guidance.
• Comfortable operating independently in a fast-growing consulting environment where priorities can evolve quickly and ownership is expected.
• CMMC credentials such as Registered Practitioner (RP), Certified Professional (CCP), or Certified Assessor (CCA) are advantageous.
• Certifications such as CISSP, CISM, or CompTIA Security+ are a plus.
• Direct experience supporting JAB or federal Agency ATO processes is highly valued.
• Previous collaboration with 3PAO or C3PAO assessment teams is beneficial.
• Must be authorized to work in the United States without current or future visa sponsorship.
• Able to work a standard schedule of 8:00 AM–5:00 PM U.S. Eastern Time, with occasional flexibility as business needs require.
• Willingness to travel locally for occasional onsite meetings, team gatherings, or business activities.
• Reliable high-speed internet and a professional home-office environment suitable for confidential client work and virtual collaboration.

Benefits:

• Competitive base salary with regular performance reviews and merit-based appraisal opportunities.
• Bonus opportunities based on performance.
• Remote-first culture with the flexibility to work from anywhere in the United States.
• Mentorship, training, and structured career development opportunities.
• Reimbursement for approved role-related training and professional certification courses.
• Opportunity to deepen expertise across CMMC, NIST, FedRAMP, and federal cybersecurity compliance.
• Growth opportunities within a fast-paced, early-stage environment.
• Collaborative culture with exposure to complex cybersecurity and compliance engagements.