GRC Engineer: CMMC & FedRAMP Specialist (Remote)

Workstreet; United States; On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Career Development

Training reimbursement

Competitive compensation

Growth opportunities

Remote‑first culture

Job summary

Workstreet, a security and compliance partner for defense contractors and federal agencies, seeks a GRC Engineer with hands‑on FedRAMP, NIST SP 800‑53, and CMMC experience to guide clients through authorization lifecycles.

You will author SSPs, POA&Ms, and other artifacts, coordinate with 3PAOs and CSPs, and translate complex regulations into practical milestones while working in a remote‑first, fast‑moving startup.

Qualifications

• 2+ years in GRC roles with FedRAMP, NIST SP 800-53, and federal authorization lifecycles.
• Authoring and evaluating SSPs, POA&Ms, and other federal artifacts.
• Knowledge of DFARS, CUI data lifecycles, and government cloud models.
• Strong written and verbal English communication for cross‑functional teams.

Responsibilities

• Analyze NIST SP 800-53 controls and FedRAMP baselines for client architectures.
• Author SSPs, POA&Ms, SAPs, and SARs and keep them up to date.
• Conduct readiness assessments for JAB/Agency ATO pathways.
• Architect authorization boundaries across FedRAMP and CMMC environments.
• Coordinate with CSPs, 3PAOs, and federal stakeholders throughout assessments.
• Advise on CMMC 2.0 and NIST SP 800-171 controls for defense contractors.
• Prepare materials for CMMC Level 1 & 2 assessment readiness.

Skills

GRC experience

FedRAMP knowledge

NIST SP 800-53

CMMC knowledge

Client-facing communication

Project coordination

Job description

Workstreet, a security and compliance partner for defense contractors and federal agencies, seeks a GRC Engineer with hands‑on FedRAMP, NIST SP 800‑53, and CMMC experience to guide clients through authorization lifecycles.

You will author SSPs, POA&Ms, and other artifacts, coordinate with 3PAOs and CSPs, and translate complex regulations into practical milestones while working in a remote‑first, fast‑moving startup.