Senior GRC Engineer: FedRAMP/NIST & CMMC (Remote)

Workstreet; United States; Remote; USD 110,000 - 165,000; Full time

Benefits offered by this job

Career development

Training & certifications

Competitive compensation

Growth opportunities

Remote-first culture

Job summary

Workstreet is seeking a GRC Engineer to guide federal compliance initiatives for defense contractors and SaaS clients. The role requires strong knowledge of FedRAMP Moderate/High, NIST SP 800-53, and CMMC 2.0, with the ability to translate complex requirements into actionable milestones and deliverables.

You will author SSPs/POA&Ms, conduct readiness assessments, map data flows, coordinate with CSPs and 3PAOs, and lead ConMon cycles while maintaining high-quality documentation across multiple

Qualifications

• 2+ years of direct execution in GRC roles
• Experience authoring, evaluating, and maintaining federal artifacts (SSP, POA&Ms)
• Familiarity with DFARS, CUI data lifecycles, and government clouds

Responsibilities

• Analyze and apply NIST SP 800-53 controls and FedRAMP baselines.
• Author and update SSPs, POA&Ms, SAPs, and SARs.
• Perform readiness assessments and gap analyses for JAB/Agency ATO.
• Architect authorization boundaries across FedRAMP and CMMC.
• Execute ConMon cycles with monthly vulnerability logs and incident reports.
• Coordinate assessment pipelines with CSPs and 3PAOs.
• Advise on CMMC 2.0 and NIST SP 800-171 controls.
• Prepare structured compliance documentation for CMMC Level 1 & 2.

Skills

GRC

FedRAMP

NIST SP 800-53

CMMC

Client-facing

Documentation

JAB/ATO

Education

CISSP

CISM

CompTIA Security+

Tools

AWS GovCloud

Azure Government

Job description

Workstreet is seeking a GRC Engineer to guide federal compliance initiatives for defense contractors and SaaS clients. The role requires strong knowledge of FedRAMP Moderate/High, NIST SP 800-53, and CMMC 2.0, with the ability to translate complex requirements into actionable milestones and deliverables.

You will author SSPs/POA&Ms, conduct readiness assessments, map data flows, coordinate with CSPs and 3PAOs, and lead ConMon cycles while maintaining high-quality documentation across multiple