Senior GRC Implementation Engineer (FedRAMP / SOC 2)

Moraph LLC; New York (NY); On-site; USD 220,000 - 250,000; Full time

Job summary

Moraph LLC is seeking an experienced GRC engineer to own FedRAMP High and SOC 2 Type II controls across our SaaS products and managed landing zones. You will translate control requirements into automated configuration and generate evidence for auditors.

You will map controls to platform configurations, build governance-as-code pipelines for SSP artifacts, and monitor for configuration drift with engineering teams.

Qualifications

• 5+ years in GRC engineering, security compliance or cloud security.
• Hands-on experience delivering a FedRAMP (Moderate or High) or SOC 2 Type II program.
• Working knowledge of AWS or Azure security services and infrastructure-as-code.
• Ability to explain control intent to engineers and evidence quality to auditors.
• US citizenship required for access to FedRAMP boundaries.

Responsibilities

• Map FedRAMP High, SOC 2 and NIST 800-53 controls to concrete platform configuration and automated checks.
• Build governance-as-code pipelines that generate System Security Plan artifacts from live configuration.
• Run continuous control monitoring and drive remediation of configuration drift with engineering teams.
• Prepare evidence packs for client audits and support assessors during authorization cycles.
• Advise product teams on control inheritance for newly acquired applications moving into our boundary.

Skills

GRC engineering

Security compliance

Cloud security

FedRAMP

SOC 2 Type II

NIST 800-53

Auditor liaison

Tools

AWS

Azure

Infrastructure-as-Code

Job description

Turn control frameworks into working configuration. You will own the technical implementation of FedRAMP High and SOC 2 Type II controls across our proprietary SaaS and managed landing zones, and produce the evidence our clients hand to their auditors.

What you'll do

• Map FedRAMP High, SOC 2 and NIST 800-53 controls to concrete platform configuration and automated checks
• Build "governance-as-code" pipelines that generate System Security Plan artifacts from live configuration
• Run continuous control monitoring and drive remediation of configuration drift with engineering teams
• Prepare evidence packs for client audits and support assessors during authorization cycles
• Advise product teams on control inheritance for newly acquired applications moving into our boundary

What you'll bring

• 5+ years in GRC engineering, security compliance or cloud security
• Hands-on experience delivering a FedRAMP (Moderate or High) or SOC 2 Type II program
• Working knowledge of AWS or Azure security services and infrastructure-as-code
• Ability to explain control intent to engineers and evidence quality to auditors
• US citizenship required for access to FedRAMP boundaries

Compensation

$220,000 – $250,000 per year.