Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 19 hours agoWe saw it 68 min after it went up

GRC Engineer - GOV (FedRAMP 20x)

Jobgether3,387 open roles

Where
US
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowGRC Engineer - GOV (FedRAMP 20x)Jobgether · US

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Jobgether's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

9.8% of postings close within 7 days. Measured by our own scanner across the market. Jobgether postings stay open a median of 6 days.

Share of postings closed within
  1. 1.9%1 day
  2. 3.9%3 days
  3. 9.8%7 days
  4. 15.5%14 days
  5. 33.7%30 days
This job: posted 19 hours ago

Jobgether median: 6 days open

The posting

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a GRC Engineer – GOV (FedRAMP 20x) based in the United States.

Join a fast-growing cybersecurity and compliance environment helping organizations strengthen their security posture and meet demanding federal requirements. In this hands-on role, you will support government compliance initiatives by translating regulatory standards into practical, technology-driven solutions. You will contribute to FedRAMP 20x certification efforts, automated evidence collection, and continuous security monitoring. Working closely with client engineering teams, compliance professionals, and independent assessors, you will help organizations identify and remediate security gaps. You will use tools and technologies such as OSCAL, JSON, YAML, cloud security platforms, and policy-as-code solutions to improve compliance efficiency. This opportunity offers close collaboration with experienced practitioners, ongoing mentorship, and exposure to evolving federal cybersecurity frameworks. If you are detail-oriented, technically curious, and passionate about security automation, this role offers an opportunity to make a meaningful impact on the security of government and defense-related systems.

Accountabilities

  • FedRAMP 20x Compliance Execution: Analyze and apply FedRAMP Consolidated Rules (CR26) and the 46 Key Security Indicators (KSIs) across 10 control families to help ensure that software architectures meet applicable federal security requirements.
  • Machine-Readable Compliance Documentation: Create, update, and maintain technical certification artifacts, including Security Decision Records, Security Configuration Guides, and OSCAL-based documentation using JSON and YAML in accordance with applicable technical specifications and federal guidance.
  • Automated Evidence Collection: Build, implement, and maintain automated evidence pipelines that continuously validate security controls and KSIs, reducing reliance on manual, point-in-time audit processes.
  • Readiness and Gap Assessments: Conduct technical readiness reviews, map security controls, and assess compliance against FedRAMP 20x Class A, Class B, and Class C baseline requirements.
  • Continuous Security Monitoring: Support Collaborative Continuous Monitoring (CCM) initiatives by integrating cloud security posture management (CSPM) and governance, risk, and compliance (GRC) tools into monitoring workflows that provide ongoing security validation.
  • Third-Party Assessment Support: Coordinate evidence collection, documentation submissions, and assessment logistics for Third-Party Assessment Organization (3PAO) audits and independent security assessments under senior team guidance.
  • Security Remediation: Collaborate with client and internal technical teams to investigate compliance deficiencies and implement remediation measures across cloud and multi-cloud environments.
  • Regulatory Monitoring: Track changes to CR26 requirements, Significant Change Notifications (SCNs), and the transition from FedRAMP Rev. 5 to FedRAMP 20x to help maintain alignment with evolving federal standards.
  • Client Collaboration: Work directly with client engineering and compliance stakeholders to communicate findings, coordinate deliverables, and ensure progress across multiple compliance workstreams.
  • Project and Delivery Management: Manage concurrent technical tasks, maintain accurate documentation, meet deadlines, and escalate risks or blockers promptly while working under senior guidance.
  • Professional Experience: At least 2 years of direct technical experience delivering governance, risk, and compliance (GRC) work involving NIST SP 800-53, FedRAMP, or federal security authorization programs.
  • FedRAMP 20x Knowledge: Foundational understanding of the FedRAMP 20x certification model, Class A/B/C classifications, CR26 rules, and KSI-based security validation.
  • Technical Documentation: Practical experience creating or maintaining machine-readable compliance artifacts using OSCAL, JSON, YAML, or comparable structured documentation formats.
  • Cloud Security Expertise: Familiarity with cloud infrastructure platforms such as AWS, Microsoft Azure, or Google Cloud Platform, ideally including government cloud environments such as AWS GovCloud or Azure Government.
  • Compliance Automation: Working knowledge of scripting or policy-as-code technologies, including Python, Rego/OPA, or Terraform, with the ability to contribute to automated evidence collection and control validation.
  • Security and Compliance Fundamentals: Understanding of security controls, risk assessment, remediation processes, technical evidence gathering, and federal authorization requirements.
  • Analytical and Organizational Skills: Strong attention to detail, effective problem-solving abilities, and the capacity to manage multiple compliance deliverables simultaneously while maintaining accuracy and quality.
  • Communication Skills: Excellent written and verbal English communication skills, with the ability to collaborate professionally with client engineering teams, compliance stakeholders, and external assessors.
  • Preferred Security Certifications: CompTIA Security+, Certified in Governance, Risk and Compliance (CGRC), Certified Authorization Professional (CAP), or Associate of CISSP credentials are advantageous.
  • Preferred Cloud Certifications: AWS Solutions Architect – Associate, Azure Security Engineer Associate, Google Cloud Associate Cloud Engineer, or comparable technical certifications are beneficial.
  • Preferred Assessment Experience: Previous involvement in 3PAO audits, agency Authority to Operate (ATO) evaluations, FedRAMP continuous monitoring, or Collaborative Continuous Monitoring workflows is a plus.
  • Additional Framework Knowledge: Familiarity with CMMC 2.0 and NIST SP 800-171 requirements, particularly in defense supply chain environments, is desirable.
  • Remote Work Readiness: Ability to work remotely with a reliable, high-speed internet connection and a professional home office suitable for confidential discussions and uninterrupted collaboration.
  • Working Hours and Travel: Availability to work a standard schedule of 8:00 AM to 5:00 PM U.S. Eastern Time, with occasional flexibility to accommodate business needs, and willingness to travel locally for occasional in-person meetings or team activities.
  • Work Authorization: Must be legally authorized to work in the United States without current or future employer-sponsored visa support or transfer.
  • Competitive Compensation: Competitive base salary, regular performance reviews, merit-based compensation adjustments, and bonus opportunities.
  • Career Development: Opportunities for professional growth within a fast-growing organization, with a clear path for career advancement.
  • Training and Certifications: Reimbursement for approved training programs and professional certification courses relevant to the role.
  • Mentorship: Opportunities to learn from experienced cybersecurity and GRC practitioners while developing specialized expertise in federal compliance and security automation.
  • Remote-First Flexibility: Work remotely from the United States while collaborating with a global team.
  • Technical Exposure: Hands-on experience with FedRAMP 20x, automated compliance workflows, cloud security environments, and emerging compliance-as-code practices.
  • Collaborative Environment: Work alongside a supportive team that values technical excellence, continuous learning, clear communication, and high-quality client delivery.
  • Meaningful Impact: Contribute to strengthening cybersecurity and compliance across government organizations, federal service providers, and defense-related environments.

How Jobgether works:

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Jobgether's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Jobgether's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Jobgether's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.