GRC Engineer, CMMC

🕒 August 19

🇺🇸 United States – Remote

⏰ Full Time

🟢 Junior

🟡 Mid-level

🚔 Compliance

🚫👨‍🎓 No degree required

👻 Ghost score 50%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Workstreet

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2023

🔒 Cybersecurity

📋 Compliance

🤝 B2B

Cybersecurity • Compliance • B2B

Workstreet is a managed security and compliance services provider that helps businesses automate and modernize their security programs. With expertise in compliance frameworks including SOC 2, ISO 27001, HIPAA, and GDPR, Workstreet supports companies in achieving their security and compliance outcomes efficiently. Their services include acting as a virtual Chief Information Security Officer (vCISO), full-scale penetration testing, and vendor risk management, aiming to streamline security processes while allowing businesses to focus on growth.

📋 Description

• Analyze and apply NIST SP 800-53 controls and FedRAMP Moderate and High baselines to client software architectures • Author and update System Security Plans, control implementation narratives, POA&Ms, SAPs, and SARs • Perform readiness assessments and gap analyses for JAB or Agency ATO validation paths • Architect authorization boundaries and scoping profiles across FedRAMP and CMMC environments • Map data flows, interconnectivity, and shared responsibility models • Execute continuous monitoring cycles, including monthly vulnerability management logs, incident response reports, and change control workflows • Coordinate external assessment pipelines among clients, Cloud Service Providers, 3PAOs, and federal stakeholders • Advise defense contractors on CMMC 2.0 and NIST SP 800-171 controls • Translate regulatory requirements into actionable security milestones • Create compliance documentation for CMMC Level 1 and Level 2 assessment readiness • Guide SaaS providers and federal contractors through FedRAMP readiness, authorization support, and continuous monitoring • Lead high-quality delivery across multiple client engagements

🎯 Requirements

• 2+ years of direct execution in GRC roles with active exposure to FedRAMP, NIST SP 800-53, and federal authorization lifecycles • Hands-on experience authoring, evaluating, and maintaining System Security Plans (SSPs) and Plans of Action and Milestones (POA&Ms) • Knowledge of CMMC 2.0 and NIST SP 800-171 requirements • Familiarity with shared responsibility models, operational constraints, and secure configurations of AWS GovCloud, Azure Government, or Microsoft GCC High • Strong project management skills supporting multiple client compliance initiatives simultaneously • Experience partnering with B2B SaaS providers, federal contractors, or regulated technology companies • Experience in consulting or fast-growth startup environments • Excellent written and verbal English communication skills • Reliable, high-speed internet connection and professional home office environment • Availability for a standard schedule of 8:00 AM–5:00 PM US Eastern Time, with occasional flexibility • Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities • Must participate in live video interviews with camera on and verify identity during recruitment and onboarding • Employment contingent upon identity verification and background screening, where permitted by law • Must be authorized to work in the U.S. without current or future visa sponsorship • Direct JAB or Agency ATO execution experience, CMMC RP/CCP/CCA designation, CISSP/CISM/CompTIA Security+, DFARS and CUI knowledge, SPRS workflow knowledge, and 3PAO/C3PAO assessment experience are listed as helpful qualifications

🏖️ Benefits

• Career development with mentorship and training opportunities • Reimbursement for approved role-related training and certification courses • Competitive base salary with regular performance reviews linked to merit-based appraisals • Bonus opportunities • Significant room for career advancement • Remote-first culture with flexibility to work from anywhere while collaborating with a global team