Senior GRC & Cloud Security Lead - ATO & FedRAMP

TechSur Solutions, LLC; Reston (VA); On-site; USD 139,000 - 155,000; Full time

Job summary

TechSur Solutions, LLC is seeking a Senior Security Specialist to lead Authority to Operate (ATO) efforts for cloud services across AWS/Azure/GCP. You will ensure RMF/NIST SP 800-53 Rev 5 and FedRAMP alignment, coordinate with 3PAO, and drive continuous monitoring and security reporting.

You will work with cloud engineers and customer security teams to maintain compliant landing zones, pipelines, and shared services, and brief security leadership in monthly reviews.

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS or related field.
• 9+ years in information security including controls and ATO leadership.
• Deep knowledge of RMF (SP 800-37) and SP 800-53 Rev 5.
• Experience writing SSPs and managing SAP/SAR and POA&M with 3PAO.

Responsibilities

• Lead ATO prep for cloud services under RMF, SP 800-53 Rev 5, and FedRAMP.
• Develop and maintain SSPs, control statements, and responsibility matrices.
• Coordinate with 3PAO; support SAP/SAR, evidence collection, and interviews.
• Manage POA&Ms; track gaps, owners, and remediation dates in ServiceNow.
• Run continuous monitoring using CSP tools and produce monthly reports.
• Review architectures and CI/CD for Zero Trust and CIS benchmarks.

Skills

NIST RMF

Technical writing

Briefing senior stakeholders

Cloud security

Vulnerability management

GRC coordination

Risk assessment

Continuous monitoring

Education

Bachelor's degree in Cybersecurity, IT or CS

Tools

Xacta

eMASS

ServiceNow IRM/GRC

Job description

TechSur Solutions, LLC is seeking a Senior Security Specialist to lead Authority to Operate (ATO) efforts for cloud services across AWS/Azure/GCP. You will ensure RMF/NIST SP 800-53 Rev 5 and FedRAMP alignment, coordinate with 3PAO, and drive continuous monitoring and security reporting.

You will work with cloud engineers and customer security teams to maintain compliant landing zones, pipelines, and shared services, and brief security leadership in monthly reviews.