GRC Program Architect: Federal Compliance & Security Controls

Onebrief; United States; Hybrid; USD 150,000 - 230,000; Full time

Job summary

Onebrief is seeking a GRC Program Architect to lead the design and implementation of its GRC framework across RMF, FedRAMP, CMMC, and SOC 2, ensuring a robust control environment. You will partner with Product, Engineering, and IT to translate compliance requirements into concrete controls and evidentiary artifacts.

With 5+ years in GRC or security, you will manage third-party audits, drive integration with CI/CD pipelines, and communicate regulatory language clearly to internal teams.

Qualifications

• 5+ years of experience in GRC, security engineering, or a combined compliance and technical security role.
• Direct experience with RMF, FedRAMP, CMMC, or equivalent federal compliance frameworks.
• Hands-on experience implementing technical security controls, such as IAM, logging and monitoring, network segmentation, or encryption.
• Working knowledge of security control frameworks such as NIST 800-53 or NIST 800-171.
• Experience managing third-party audits and assessor relationships.
• Strong written communication skills, with the ability to translate regulatory language into clear technical and internal guidance.

Responsibilities

• Own the design and implementation of Onebrief's GRC framework across RMF, FedRAMP, CMMC, SOC 2, and other applicable standards.
• Build and manage the control environment, including policies, procedures, and evidence collection systems.
• Design and implement technical security controls in partnership with Product, Engineering, Infrastructure and Corporate IT including access management, logging, encryption, and vulnerability management practices.
• Partner with Engineering, Infrastructure, and Corporate IT to translate compliance requirements into working technical controls, not just documented ones.

Skills

GRC experience

Security engineering

Compliance & security

Audits

Regulatory frameworks

CI/CD security

NIST standards

Third-party audits

Written communication

Infrastructure as code

Tools

RegScale

eMASS

Job description

Onebrief is seeking a GRC Program Architect to lead the design and implementation of its GRC framework across RMF, FedRAMP, CMMC, and SOC 2, ensuring a robust control environment. You will partner with Product, Engineering, and IT to translate compliance requirements into concrete controls and evidentiary artifacts.

With 5+ years in GRC or security, you will manage third-party audits, drive integration with CI/CD pipelines, and communicate regulatory language clearly to internal teams.