Strategic GRC Director for Federal and Client Compliance

Atmosera; United States; Remote; USD 150,000 - 230,000; Full time

Job summary

Atmosera seeks a Director of Governance, Risk & Compliance (GRC) to lead the internal GRC program and MGRC services. This hands-on leadership role drives strategy, service delivery, team leadership, client engagements, and continuous improvement across federal security programs and regulatory frameworks.

The role collaborates with CISOs, auditors, engineers, and control owners to validate control implementations, manage SSPs, POA&Ms, and evidence, and scale automation and AI-driven GRC delivery.

Qualifications

• 8+ years of cybersecurity, GRC, security assessment, audit, or related experience.
• Demonstrated experience leading GRC programs or teams.
• Hands-on experience with NIST SP 800-53, System Security Plans, POA&Ms, control implementation statements, and federal security requirements.
• Experience managing audits, evidence, risk assessments, control gaps, policies, and remediation programs.
• Ability to translate regulatory requirements into technical and operational security controls.
• Strong client-facing, executive communication, and technical stakeholder management skills.
• Public Trust within 90 days of employment.

Responsibilities

• Lead Atmosera's internal GRC program and operational delivery of MGRC services.
• Establish standardized methodologies, processes, templates, evidence requirements, and quality controls.
• Lead risk assessments, control assessments, compliance readiness, policy governance, Managed Audit, Managed Questionnaires, and other GRC engagements.
• Manage client commitments, priorities, capacity, deliverable quality, and service performance.
• Identify opportunities for automation and AI to improve GRC delivery and scalability.
• Partner with Sales and Client Success on service scoping, SOWs, pricing, and complex opportunities.
• Lead and maintain System Security Plans for federal clients.
• Develop and review control implementation statements and supporting evidence.
• Coordinate with technical control owners to validate how controls are implemented.
• Manage POA&Ms, control deficiencies, remediation activities, milestones, and dependencies.
• Coordinate responses to government, assessor, and auditor findings and requests.
• Facilitate SSP and control working sessions with clients, engineers, security teams, and other stakeholders.
• Support continuous monitoring, security assessments, and authorization activities.
• Maintain alignment between documented controls and the actual operating environment.
• Support requirements involving NIST SP 800-53, NIST SP 800-171, FISMA, CMMC, FedRAMP concepts, and agency-specific requirements.
• Lead cybersecurity risk assessments, control gap assessments, risk registers, treatment plans, exceptions, and remediation tracking.
• Support frameworks including SOC 2, NIST, CIS, ISO 27001, PCI DSS, HIPAA, CMMC, and Microsoft security benchmarks.
• Own Atmosera's Managed Audit methodology, including audit readiness, evidence management, auditor coordination, findings, and remediation.
• Oversee Managed Security Questionnaire delivery and development of reusable response and evidence libraries.
• Ensure policies, standards, procedures, and control documentation accurately reflect operational practices.
• Partner with the CISO to operate and mature Atmosera's internal security and compliance program.

Skills

GRC leadership

Cybersecurity

Risk assessment

Security audits

NIST SP 800-53

Executive communications

Federal security requirements

Tools

POA&Ms

SSP management

Audit evidence

Job description

Atmosera seeks a Director of Governance, Risk & Compliance (GRC) to lead the internal GRC program and MGRC services. This hands-on leadership role drives strategy, service delivery, team leadership, client engagements, and continuous improvement across federal security programs and regulatory frameworks.

The role collaborates with CISOs, auditors, engineers, and control owners to validate control implementations, manage SSPs, POA&Ms, and evidence, and scale automation and AI-driven GRC delivery.