smartrecruiters

Senior Security Specialist (GRC)

TechSur Solutions

Reston, USA

Full-time

Senior · 9+ years experience

Hybrid

Discovered 1 weeks ago

sapservicenowsplunk

Full Job Posting

Lead ATO preparation for cloud services under NIST SP 800-37 (RMF), NIST SP 800-53 Rev 5, and FedRAMP Moderate/High processes.
Develop and maintain System Security Plans, control implementation statements, Customer Responsibility Matrices, and CSP control-inheritance documentation.
Coordinate with a Third-Party Assessment Organization (3PAO): support Security Assessment Plans and Reports (SAP/SAR), gather evidence, facilitate interviews, and respond to findings.
Manage Plans of Action and Milestones (POA&Ms): track gaps, owners, and remediation dates in ServiceNow and help engineering teams close findings.
Run continuous monitoring with CSP-native and third-party tools (AWS Security Hub, Microsoft Defender for Cloud, GCP Security Command Center, OCI Cloud Guard, Prisma Cloud) and produce monthly compliance reports.
Prioritize vulnerabilities using CVSS, exploitability, and customer risk ratings.
Review architectures, IaC templates, and CI/CD pipelines for alignment with Zero Trust (NIST SP 800-207), CIS Benchmarks, and customer security standards.
Help develop incident response playbooks mapped to MITRE ATT&CK and take part in tabletop exercises.
Brief customer security leadership and present security posture at monthly Security & Compliance reviews.

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field.
At least 9 years of information security experience, including implementing and managing security controls and leading ATO efforts.
Deep working knowledge of the NIST RMF (SP 800-37) and NIST SP 800-53 Rev 5 control families.
Hands-on experience writing SSPs and managing SAP/SAR and POA&M processes with a 3PAO or agency assessor.
Experience performing continuous security assessments and monitoring in cloud environments.
Strong technical writing skills and the ability to brief senior government stakeholders.
Ability to obtain and maintain the background investigation required by the federal customer.
CISSP, CISM, CGRC (formerly CAP), CRISC, or CCSP certification.
Experience with FedRAMP Moderate or High authorizations for multi-cloud environments.
Experience with OSCAL-based security documentation and GRC platforms (e.g., ServiceNow IRM/GRC, Xacta, eMASS).
Familiarity with agency-specific security frameworks built on NIST SP 800-53.
Experience with CSPM tools and Splunk-based security monitoring.
Prior support of a civilian federal agency.

CISSP, CISM, CGRC (formerly CAP), CRISC, or CCSP certification.
Experience with FedRAMP Moderate or High authorizations for multi-cloud environments.
Experience with OSCAL-based security documentation and GRC platforms (e.g., ServiceNow IRM/GRC, Xacta, eMASS).
Familiarity with agency-specific security frameworks built on NIST SP 800-53.
Experience with CSPM tools and Splunk-based security monitoring.
Prior support of a civilian federal agency.
All your information will be kept confidential according to EEO guidelines.
TechSur Solutions is a digital services company whose mission is to enable digital transformation for our customers to improve quality and efficiency. Based in the DC metropolitan area, TechSur specializes in advanced cloud services, modernization for both IT structures and applications, leveraging Agile development, and Data Analytics. Since we were formed in August of 2016, we have supported multiple impactful and exciting government programs.

Skip the repetitive application forms

Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.

Trusted by over 500,000 job seekers on Base Career