GRC Engineer (NIST)
A GRC Engineer supports U.S. defense contractors and federal organizations in achieving NIST, FedRAMP, and CMMC compliance. Daily tasks include mapping NIST controls, authoring security documentation, conducting gap assessments, and guiding clients through authorization processes while maintaining clear communication and adherence to federal security standards.
- Compensation
- Not disclosed
- Location
- Remote (United States)
- Work setup
- Remote
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 2+ years
- Category
- Security
- Posted
Skills
Must have
- 2+ years of direct experience executing GRC deliverables across NIST SP 800-53, FedRAMP, or NIST RMF lifecycles
- Hands-on experience creating, evaluating, and maintaining System Security Plans (SSPs), POA&Ms, and technical security narratives
- Demonstrated ability to manage multiple federal compliance project tasks simultaneously
- Familiarity with cloud service providers (CSPs) and secure configurations in government clouds like AWS GovCloud or Azure Government
- Strong written and verbal English communication skills for direct engagement with U.S. client technical leads and assessors
Nice to have
- Active security credentials such as CGRC, CAP, CISSP, or CompTIA Security+
- Direct ATO or 3PAO execution experience
- Experience with FedRAMP Continuous Monitoring (ConMon) workflows
- Exposure to CMMC 2.0 or NIST SP 800-171 baselines
Full description
Get to know the GRC Engineering (GOV) Team
Our GRC engineering team guides defense contractors and federal organizations through their CMMC, NIST SP 800-171, NIST SP 800-53, FedRAMP, and Assessment & Authorization compliance efforts. We act as our clients' trusted guides and primary point of contact end-to-end, leading them through gap assessments, System Security Plans, POA&Ms, and C3PAO/3PAO coordination with clarity, composure, and a genuinely client-first mindset. Beyond the technical depth in RMF, CUI/DFARS requirements, and GovCloud environments, what defines us is how we work: we translate complex requirements into plain language, manage escalations with urgency and care, and take real pride in making every client feel informed, supported, and well-prepared. We're a group that mentors one another, holds a high bar for quality, and thrives in a fast-paced environment where our work directly strengthens the security of the defense industrial base.
The Opportunity
Workstreet is seeking a GRC Engineer (NIST 800-53/FedRAMP) who is highly motivated, detail-oriented, and possesses foundational knowledge of NIST SP 800-53 and FedRAMP Moderate and High baseline requirements. Operating as a key technical contributor within our government delivery practice, this role focuses on supporting client-facing compliance initiatives, authoring authorization artifacts, and executing gap assessments across the Assessment and Authorization (A&A) lifecycle.
The successful candidate will combine strong communication skills with the organizational discipline to manage multiple compliance projects concurrently under senior guidance. In this role, you will partner directly with organizations pursuing federal authorizations, assist with 3PAO assessment preparation, and help clients achieve and sustain compliance across government clouds during U.S. Eastern Time business hours.
What You'll Do
- Execute NIST 800-53 control mappings - analyze and apply NIST SP 800-53 security and privacy controls and control baselines to ensure software architectures meet federal agency standards.
- Author core authorization documentation - create, update, and maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and supporting A&A artifacts.
- Conduct readiness and gap assessments - perform technical gap analyses and readiness reviews to prepare clients for federal agency ATO or FedRAMP authorization validation paths.
- Support continuous monitoring operations - assist with continuous monitoring (ConMon) cycles by tracking monthly vulnerability logs, POA&M updates, and structural change requests.
- Facilitate external assessment activities - guide clients through the Assessment and Authorization (A&A) process and coordinate operational logistics with 3PAOs and independent assessors.
- Assist in control remediation efforts - partner with internal and client technical teams to remediate control deficiencies across Low, Moderate, and High baselines.