GRC Engineer – GOV, FedRAMP 20x

Workstreet

. Execute FedRAMP 20x control validation by applying CR26 and 46 KSIs across 10 families .

Posted 10/14/2026full-timeRemote • United StatesJuniorMid-LevelWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in executing FedRAMP compliance tasks, including GRC deliverables and technical compliance artifacts using OSCAL, JSON, and YAML. Proficient in managing multi-cloud environments and coordinating compliance activities under senior guidance.

Highest-signal resume keywords

FedRAMP ComplianceGRC DeliverablesOSCAL/JSON/YAML DocumentationAWS/Azure/GCP ExperienceSecurity Certification

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Technical Compliance ArtifactsKSI Validation ModelsControl MappingEvidence-Gathering PipelinesPython ScriptingTerraformRego/OPANIST SP 800-53CMMC 2.0 Familiarity3PAO Audit Participation

Soft Skills

Strong Written CommunicationStrong Verbal CommunicationCoordination SkillsCollaboration Skills

Tools & Technologies

CSPM ToolingGRC ToolingMulti-Cloud EnvironmentsContinuous Monitoring Workflows

Certifications & Qualifications

CompTIA Security+CGRCCAPAssociate of CISSPAWS Solutions Architect AssociateAzure Security Engineer AssociateGCP Associate Cloud Engineer

Industry Keywords

FedRAMP 20xFederal Authorization LifecyclesTechnical Readiness ReviewsGap AssessmentsCompliance TasksSignificant Change NotificationsU.S. Eastern Time Availability

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformPythonTerraform

About the role

Key responsibilities & impact

Execute FedRAMP 20x control validation by applying CR26 and 46 KSIs across 10 families
Author and maintain machine-readable Security Decision Records, Security Configuration Guides, and OSCAL/JSON/YAML documentation conforming to RFC-0024 and OMB M-24-15
Design and maintain automated evidence-gathering pipelines for continuous KSI validation
Conduct technical readiness reviews, gap assessments, and control mapping for FedRAMP 20x Class A, B, and C baselines
Support Collaborative Continuous Monitoring by connecting CSPM and GRC tooling to agency pipelines
Coordinate evidence submission and logistics for 3PAO audits and independent assessments under senior guidance
Collaborate with internal and client technical teams to remediate security gaps across multi-cloud environments
Monitor CR26 updates, Significant Change Notifications, and the Rev5-to-20x transition timeline
Partner directly with client engineering and compliance leads
Manage multiple compliance tasks concurrently under senior guidance during U.S. Eastern Time business hours

Requirements

What you’ll need

2+ years of direct technical experience executing GRC deliverables across NIST SP 800-53, FedRAMP, or federal authorization lifecycles
Foundational understanding of FedRAMP 20x Program Certifications (Class A/B/C), CR26 rules, and KSI-based validation models
Hands-on experience creating or working with technical compliance artifacts using OSCAL, JSON, or YAML schemas
Practical exposure to AWS, Azure, GCP, AWS GovCloud, or Azure Government
Working ability with Python, Rego/OPA, Terraform, or other scripting/policy-as-code tools
Ability to coordinate multiple federal compliance tasks concurrently
Strong written and verbal English communication skills
Recognized security certification such as CompTIA Security+, CGRC, CAP, or Associate of CISSP
Technical cloud certification such as AWS Solutions Architect Associate, Azure Security Engineer Associate, or GCP Associate Cloud Engineer
Practical history participating in 3PAO audits or supporting live agency ATO evaluations
Experience supporting FedRAMP ConMon or Collaborative Continuous Monitoring (CCM) workflows
Familiarity with CMMC 2.0 or NIST SP 800-171 requirements
Reliable, high-speed internet connection and professional home office environment
Availability to work 8:00 AM–5:00 PM US Eastern Time, with occasional schedule flexibility
Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities
Must be authorized to work in the U.S. without visa sponsorship now or in the future
Must participate in live video interviews with camera on and verify identity during recruitment and onboarding
Employment contingent upon identity verification and background screening, where permitted by law

Benefits

Comp & perks

Career development with mentorship and training opportunities
Reimbursement for approved training and certification courses relevant to the current role
Competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities
Significant room for career advancement
Remote-first work flexibility
Ability to work from anywhere while collaborating with a global team