GRC Engineer
Rockville, MD - Mostly Remote Role Overview As a GRC Engineer, you will bridge the gap between regulatory requirements and modern cloud engineering. You will combine deep, traditional Assessment & Authorization (A&A) expertise with modern software development, Infrastructure-as-Code (IaC), and automation to convert manual, snapshot compliance into continuous, code-driven guardrails.
The work is mostly remote with occasional onsite meetings. Must be able to obtain a Public Trust.
Job Description - Lead end-to-end A&A processes under the NIST Risk Management Framework (RMF), authoring and maintaining core security artifacts (SSPs, SARs, POA&Ms) to achieve and maintain Authorizations to Operate (ATO).
- Replace manual spreadsheets and static screenshots with continuous telemetry and automated pipelines using cloud-native tools (e.g., AWS Audit Manager, AWS Config) and GRC platforms (Archer, Xacta).
- Translate abstract requirements from frameworks like NIST SP 800-53 (Rev 4/5), NIST 800-171, FedRAMP, SOC 2, ISO 27001, and CMMC into actionable technical control specifications for engineering teams.
- Build real-time monitoring and alerting workflows to detect compliance failures instantly and execute automated remediation without breaking production systems.
- Design automated workflows, API integrations, and dashboards for vendor risk intake, security assessments, and supply chain monitoring.
- Partner closely with software developers, DevOps teams, and legal/compliance stakeholders to build developer-friendly security guardrails that maintain high engineering velocity.
- Contribute to writing code and Infrastructure-as-Code (CloudFormation) to enforce security baselines, access controls, and pre-deployment compliance checks directly inside CI/CD pipelines using tools like Open Policy Agent (OPA).
Qualifications - 5 - 8+ Years of Relevant Experience with background spanning Information Assurance, A&A/RMF, Security Engineering, DevOps, or Technical GRC.
- Deep NIST SP 800-53 Expertise with a thorough understanding of how to implement, assess, and operationalize technical security controls within NIST 800-53 and the A&A lifecycle.
- Proficiency in Python, Bash, Node.js, or Go to write scripts, consume APIs, and build evidence/automation pipelines.
- Direct experience managing and securing cloud infrastructure (AWS) using CloudFormation.
- Experience administering modern GRC automation tools (Archer, Xacta) or cloud compliance tools (e.g., AWS Audit Manager, AWS Security Hub).
- Working knowledge of additional frameworks beyond NIST, such as SOC 2, ISO 27001, FedRAMP, CMMC, or GDPR.
- Pragmatic, collaborative approach to compliance that treats security as an engineering enabler rather than an administrative blocker.
Preferred - Industry Certifications: CISSP, Certified in Governance, Risk and Compliance (CGRC/CAP), CISM, or AWS Certified Security - Specialty.
- Hands-on experience writing OPA/Rego policies, Sentinel, or static code analysis rules (e.g., Checkov, tfsec).
- Experience managing formal government ATO pathways, 3PAO assessments, or FedRAMP High/Moderate baselines.
- Experience in migrating between GRC platforms.
- Current or previous Public Trust.
#cjjobs
