Program Architect - Governance, Risk, and Compliance

Onebrief; United States; Hybrid; USD 150,000 - 230,000; Full time

Job summary

Onebrief is seeking a GRC Program Architect to lead the design and implementation of its GRC framework across RMF, FedRAMP, CMMC, and SOC 2, ensuring a robust control environment. You will partner with Product, Engineering, and IT to translate compliance requirements into concrete controls and evidentiary artifacts.

With 5+ years in GRC or security, you will manage third-party audits, drive integration with CI/CD pipelines, and communicate regulatory language clearly to internal teams.

Qualifications

• 5+ years of experience in GRC, security engineering, or a combined compliance and technical security role.
• Direct experience with RMF, FedRAMP, CMMC, or equivalent federal compliance frameworks.
• Hands-on experience implementing technical security controls, such as IAM, logging and monitoring, network segmentation, or encryption.
• Working knowledge of security control frameworks such as NIST 800-53 or NIST 800-171.
• Experience managing third-party audits and assessor relationships.
• Strong written communication skills, with the ability to translate regulatory language into clear technical and internal guidance.

Responsibilities

• Own the design and implementation of Onebrief's GRC framework across RMF, FedRAMP, CMMC, SOC 2, and other applicable standards.
• Build and manage the control environment, including policies, procedures, and evidence collection systems.
• Design and implement technical security controls in partnership with Product, Engineering, Infrastructure and Corporate IT including access management, logging, encryption, and vulnerability management practices.
• Partner with Engineering, Infrastructure, and Corporate IT to translate compliance requirements into working technical controls, not just documented ones.

Skills

GRC experience

Security engineering

Compliance & security

Audits

Regulatory frameworks

CI/CD security

NIST standards

Third-party audits

Written communication

Infrastructure as code

Tools

RegScale

eMASS

Job description

Consequential Work. Dedicated People.

About Onebrief

Onebrief builds collaboration and AI-powered workflow software for military planning and operational coordination.

Today, many critical planning workflows still rely on fragmented systems, static documents, and disconnected tools that make collaboration and decision-making unnecessarily difficult. Onebrief brings modern software, AI, and real-time collaboration into those environments, helping teams operate with greater clarity, coordination, and adaptability in situations where decisions carry real-world consequences.

We are a distributed team of builders from military, operational, and technology backgrounds who care deeply about improving how important work gets done. Some team members work remotely, while others work directly alongside customers in operational environments around the world.

Founded in 2019, Onebrief is backed by leading investors including General Catalyst, Battery Ventures, Insight Partners, Sapphire Ventures, and Human Capital. Valued at more than $2 billion, we continue to invest in product innovation, AI capabilities, and team growth.

Why This Role Exists

Onebrief sells to defense and government customers. Those customers require proof, not promises, that our systems protect their data. We need a GRC Program Architect to inform the build that proof and keep it current as our compliance obligations grow.

This role owns the architecture behind our compliance posture. FedRAMP, CMMC, SOC 2, and international frameworks each impose different controls. Someone has to translate those requirements into systems, processes, and evidence that hold up under audit. That work falls to this person.

Compliance and security engineering can't operate as separate tracks here. Controls that exist only on paper don't protect anyone and don't survive an audit. This person will work hands‑on with engineering to implement the technical controls that back up our compliance claims, not just document them after the fact.

The stakes are direct. A gap in our compliance program can block a contract, delay an authorization, or put customer data at risk. A strong program does the opposite. It opens doors to new customers and gives existing ones confidence to expand their use of our platform.

What You’ll Do

Core responsibilities:

• Own the design and implementation of Onebrief's GRC framework across RMF, FedRAMP, CMMC, SOC 2, and other applicable standards.
• Build and manage the control environment, including policies, procedures, and evidence collection systems.
• Design and implement technical security controls in partnership with Product, Engineering, Infrastructure and Corporate IT including access management, logging, encryption, and vulnerability management practices.
• Partner with Engineering, Infrastructure, and Corporate IT to translate compliance requirements into working technical controls, not just documented ones.

Minimum Qualifications

• 5+ years of experience in GRC, security engineering, or a combined compliance and technical security role
• Direct experience with RMF, FedRAMP, CMMC, or equivalent federal compliance frameworks
• Hands‑on experience implementing technical security controls, such as IAM, logging and monitoring, network segmentation, or encryption
• Working knowledge of security control frameworks such as NIST 800-53 or NIST 800-171
• Experience managing third‑party audits and assessor relationships
• Strong written communication skills, with the ability to translate regulatory language into clear technical and internal guidance

Preferred Qualifications

• Experience in a startup or scaling company environment
• Background in military, defense, or government contracting
• Relevant certifications, such as CISSP, CISA, CRISC, or a technical security certification (AWS Solutions Architect)
• Experience building GRC automation using infrastructure‑as‑code or scripting

Indicators of Success

This role will evolve as priorities change, but the outcomes below reflect what success typically looks like in the first six months.

A successful GRC Program Architect will:

• Identify and remediate at least one significant security control gap before it surfaces in an external audit
• Serve as the trusted point of contact for customer security questionnaires and compliance inquiries
• Be recognized by engineering and security teams as a partner who makes compliance workable and technically sound, not just another gate to pass
• Win buy‑in from engineering leads who previously treated compliance requests as low priority
• Get through a customer or third‑party security review without escalations or fire drills

Tools, Systems & Technologies (Optional)

Experience with GRC platforms (such as RegScale, eMASS, or similar), cloud security tooling relevant to Federal environments, logging systems, CI/CD pipelines, and infrastructure‑as‑code for control automation is a plus.