Senior Security Specialist (GRC)

TechSur Solutions, LLC; Reston (VA); On-site; USD 139,000 - 155,000; Full time

Job summary

TechSur Solutions, LLC seeks a Senior Security Specialist to lead GRC and ATO activities for a federal cloud program in a multi-cloud environment (AWS, Azure, GCP, Oracle Cloud). You will ensure RMF and FedRAMP compliance across landing zones, pipelines, and shared services.

You will develop SSPs, coordinate with 3PAO, and manage POA&Ms in ServiceNow, producing monthly compliance reports. Strong Gov't writing and briefing skills are essential.

Qualifications

• Experience leading ATO efforts for cloud services.
• Knowledge of RMF (SP 800-37) and NIST 800-53 Rev 5 control families.
• Familiar with FedRAMP Moderate/High authorizations.
• Ability to document SSPs, SAP/SAR, and POA&Ms with a 3PAO or agency assessor.
• Experience with continuous security assessments and monitoring in cloud environments.
• Strong technical writing to brief senior government stakeholders.
• Ability to obtain and maintain the background investigation required.

Responsibilities

• Lead ATO preparation for cloud services under RMF/NIST SP 800-37 and FedRAMP.
• Develop and maintain SSPs, control statements, matrices, and CSP inheritance docs.
• Coordinate with a 3PAO; support SAP/SAR, evidence gathering, interviews, findings.
• Manage POA&Ms; track gaps, owners, remediation dates in ServiceNow.
• Run continuous monitoring with CSP tools and produce monthly reports.
• Prioritize vulnerabilities using CVSS and customer risk ratings.
• Review architectures and CI/CD for Zero Trust alignment and security standards.
• Assist incident response playbooks mapped to MITRE ATT&CK and tabletop exercises.
• Brief customer leadership and present security posture in reviews.

Skills

GRC governance

Cloud security

NIST RMF

FedRAMP knowledge

Security assessment

Technical writing

Stakeholder briefing

3PAO coordination

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

ServiceNow IRM/GRC

Xacta

eMASS

AWS Security Hub

Azure Security Center

GCP Security Command Center

OCI Cloud Guard

Prisma Cloud

Job description

• Active Government Security Clearance: No
• Compensation: USD 139,000 - USD 155,000 - yearly

Company Description

TechSurSolutions is a digital services company whose mission is to enable digital transformation for our customers to improve quality and efficiency.Based in the DC metropolitan area,TechSurspecializes in advanced cloud services, modernization for both ITstructuresand applications, leveraging Agile development, and Data Analytics.Since we were formed inAugust of2016,we have supported multiple impactful and excitinggovernment programs.

Job Description

TechSur is seeking a Senior Security Specialist with governance, risk, and compliance (GRC) expertise to lead Authority to Operate (ATO) work for a federal customer's new cloud services. You will guide customer cloud environments on AWS, Azure, Google Cloud, and Oracle Cloud through the NIST Risk Management Framework, from control mapping and System Security Plans to third-party assessment and continuous monitoring.

You will work with cloud engineers, customer security teams, and Authorizing Officials. You will make sure every landing zone, pipeline, and shared service is built to meet NIST SP 800-53 Rev 5, FedRAMP, and customer security requirements, and that it stays compliant once in production.

Key Responsibilities

• Lead ATO preparation for cloud services under NIST SP 800-37 (RMF), NIST SP 800-53 Rev 5, and FedRAMP Moderate/High processes.
• Develop and maintain System Security Plans, control implementation statements, Customer Responsibility Matrices, and CSP control-inheritance documentation.
• Coordinate with a Third-Party Assessment Organization (3PAO): support Security Assessment Plans and Reports (SAP/SAR), gather evidence, facilitate interviews, and respond to findings.
• Manage Plans of Action and Milestones (POA&Ms): track gaps, owners, and remediation dates in ServiceNow and help engineering teams close findings.
• Run continuous monitoring with CSP-native and third-party tools (AWS Security Hub, Microsoft Defender for Cloud, GCP Security Command Center, OCI Cloud Guard, Prisma Cloud) and produce monthly compliance reports.
• Prioritize vulnerabilities using CVSS, exploitability, and customer risk ratings.
• Review architectures, IaC templates, and CI/CD pipelines for alignment with Zero Trust (NIST SP 800-207), CIS Benchmarks, and customer security standards.
• Help develop incident response playbooks mapped to MITRE ATT&CK and take part in tabletop exercises.
• Brief customer security leadership and present security posture at monthly Security & Compliance reviews.

Qualifications

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• At least 9 years of information security experience, including implementing and managing security controls and leading ATO efforts.
• Deep working knowledge of the NIST RMF (SP 800-37) and NIST SP 800-53 Rev 5 control families.
• Hands-on experience writing SSPs and managing SAP/SAR and POA&M processes with a 3PAO or agency assessor.
• Experience performing continuous security assessments and monitoring in cloud environments.
• Strong technical writing skills and the ability to brief senior government stakeholders.
• Ability to obtain and maintain the background investigation required by the federal customer.

Preferred Qualifications

• CISSP, CISM, CGRC (formerly CAP), CRISC, or CCSP certification.
• Experience with FedRAMP Moderate or High authorizations for multi-cloud environments.
• Experience with OSCAL-based security documentation and GRC platforms (e.g., ServiceNow IRM/GRC, Xacta, eMASS).
• Familiarity with agency-specific security frameworks built on NIST SP 800-53.
• Experience with CSPM tools and Splunk-based security monitoring.
• Prior support of a civilian federal agency.

Additional Information

All your information will be kept confidential according to EEO guidelines.