GRC Engineer - GOV (FedRAMP 20x)

Workstreet; United States; Remote; USD 90,000 - 130,000; Full time

Job summary

Workstreet is seeking a GRC Engineer (FedRAMP 20x) to advance our government delivery practice. You will perform hands-on FedRAMP validation, build automated evidence pipelines, and author machine-readable artifacts to support audits.

In this role, you will collaborate with client engineering and compliance leads, coordinate 3PAO assessments, and help sustain continuous monitoring and timely remediation across FedRAMP baselines. This position follows U.S. Eastern Time hours.

Qualifications

• Hands-on experience with FedRAMP 20x requirements.
• Familiarity with CR26 rules and KSIs across multiple baselines.
• Ability to author machine-readable artifacts and documentation.

Responsibilities

• Execute FedRAMP 20x control validation across KSIs.
• Build automated evidence pipelines and artifact templates.
• Coordinate 3PAO readiness and assessments.
• Support continuous monitoring and remediation activities.

Skills

FedRAMP 20x

CR26 rules

KSIs

OSCAL

JSON

YAML

Tools

OSCAL

JSON

YAML

Job description

At Workstreet , we’re on an exciting journey to help businesses scale securely by designing and implementing cutting-edge security and compliance programs. As a fast-growing startup, we specialize in a wide range of GRC (governance, risk, and compliance) services that support frameworks across SOC 2, ISO 27001, GDPR, CMMC, NIST 800-171, NIST 800-53, and FedRAMP. We empower companies to meet regulatory requirements and enhance their cybersecurity posture from day one.

Get to know the GRC Engineering (GOV) Team

Our GRC engineering team guides defense contractors and federal organizations through their CMMC, NIST SP 800-171, NIST SP 800-53, FedRAMP, and Assessment & Authorization compliance efforts. We act as our clients' trusted guides and primary point of contact end-to-end, leading them through gap assessments, System Security Plans, POA&Ms, and C3PAO/3PAO coordination with clarity, composure, and a genuinely client‑first mindset. Beyond the technical depth in RMF, CUI/DFARS requirements, and GovCloud environments, what defines us is how we work: we translate complex requirements into plain language, manage escalations with urgency and care, and take real pride in making every client feel informed, supported, and well‑prepared. We’re a group that mentors one another, holds a high bar for quality, and thrives in a fast‑paced environment where our work directly strengthens the security of the defense industrial base.

The Opportunity

Workstreet is seeking a GRC Engineer (FedRAMP 20x) who is highly motivated, detail-oriented, and possesses foundational knowledge of FedRAMP 20x, CR26 rules, and Key Security Indicators (KSIs). Operating as a key technical contributor within our government delivery practice, this role focuses on hands‑on technical execution, building automated evidence pipelines, authoring machine‑readable artifacts, and supporting organizations through the FedRAMP 20x certification lifecycle.

The successful candidate will combine strong technical execution skills with the organizational discipline to manage multiple compliance tasks concurrently under senior guidance. In this role, you will partner directly with client engineering and compliance leads, assist with 3PAO assessment preparation, and help implement continuous monitoring pipelines to ensure clients achieve and sustain compliance during U.S. Eastern Time business hours.

What You'll Do

• Execute FedRAMP 20x control validation - analyze and apply FedRAMP Consolidated Rules (CR26) and the 46 Key Security Indicators (KSIs) across 10 families to ensure software architectures align with federal standards.
• Author machine-readable certification artifacts - create, update, and maintain Security Decision Records, Security Configuration Guides, and OSCAL/JSON/YAML documentation conforming to RFC-0024 and OMB M-24-15 mandates.
• Implement automated evidence pipelines - design and maintain automated evidence-gathering workflows to continuously validate KSIs, moving away from manual point-in-time audit procedures.
• Conduct readiness and gap assessments - perform technical readiness reviews and control mapping across FedRAMP 20x Class A, Class B, and Class C baseline requirements.
• Support Collaborative Continuous Monitoring (CCM) - assist in connecting CSPM and GRC tooling into agency pipelines to feed real‑time KSI validation data.
• Facilitate external 3PAO assessments - coordinate evidence submission and operational logistics during Third-Party Assessment Organization (3PAO) audits and independent assessments under senior guidance.
• Assist in security control remediation - collaborate with internal and client technical teams to remed