GRC Engineer

Job Description

Job Description

GRC Engineer
Rockville, MD Mostly Remote
Role Overview
As a GRC Engineer, you will bridge the gap between regulatory requirements and modern cloud engineering. You will combine deep, traditional Assessment & Authorization (A&A) expertise with modern software development, Infrastructure-as-Code (IaC), and automation to convert manual, snapshot compliance into continuous, code-driven guardrails.
The work is mostly remote with occasional onsite meetings. Must be able to obtain a Public Trust.

Job Description

• Lead end-to-end A&A processes under the NIST Risk Management Framework (RMF), authoring and maintaining core security artifacts (SSPs, SARs, POA&Ms) to achieve and maintain Authorizations to Operate (ATO).
• Replace manual spreadsheets and static screenshots with continuous telemetry and automated pipelines using cloud-native tools (e.g., AWS Audit Manager, AWS Config) and GRC platforms (Archer, Xacta).
• Translate abstract requirements from frameworks like NIST SP 800-53 (Rev 4/5), NIST 800-171, FedRAMP, SOC 2, ISO 27001, and CMMC into actionable technical control specifications for engineering teams.
• Build real-time monitoring and alerting workflows to detect compliance failures instantly and execute automated remediation without breaking production systems.
• Design automated workflows, API integrations, and dashboards for vendor risk intake, security assessments, and supply chain monitoring.
• Partner closely with software developers, DevOps teams, and legal/compliance stakeholders to build developer-friendly security guardrails that maintain high engineering velocity.
• Contribute to writing code and Infrastructure-as-Code (CloudFormation) to enforce security baselines, access controls, and pre-deployment compliance checks directly inside CI/CD pipelines using tools like Open Policy Agent (OPA).

Qualifications

• 5 - 8 Years of Relevant Experience with background spanning Information Assurance, A&A/RMF, Security Engineering, DevOps, or Technical GRC.
• Deep NIST SP 800-53 Expertise with a thorough understanding of how to implement, assess, and operationalize technical security controls within NIST 800-53 and the A&A lifecycle.
• Proficiency in Python, Bash, Node.js, or Go to write scripts, consume APIs, and build evidence/automation pipelines.
• Direct experience managing and securing cloud infrastructure (AWS) using CloudFormation.
• Experience administering modern GRC automation tools (Archer, Xacta) or cloud compliance tools (e.g., AWS Audit Manager, AWS Security Hub).
• Working knowledge of additional frameworks beyond NIST, such as SOC 2, ISO 27001, FedRAMP, CMMC, or GDPR.
• Pragmatic, collaborative approach to compliance that treats security as an engineering enabler rather than an administrative blocker.

Preferred

• Industry Certifications: CISSP, Certified in Governance, Risk and Compliance (CGRC/CAP), CISM, or AWS Certified Security - Specialty.
• Hands-on experience writing OPA/Rego policies, Sentinel, or static code analysis rules (e.g., Checkov, tfsec).
• Experience managing formal government ATO pathways, 3PAO assessments, or FedRAMP High/Moderate baselines.
• Experience in migrating between GRC platforms.
• Current or previous Public Trust.

#cjjobs
Marathon TS is committed to the development of a creative, diverse and inclusive work environment. In order to provide equal employment and advancement opportunities to all individuals, employment decisions at Marathon TS will be based on merit, qualifications, and abilities. Marathon TS does not discriminate against any person because of race, color, creed, religion, sex, national origin, disability, age or any other characteristic protected by law (referred to as "protected status ").