Senior Security Specialist (GRC)

TechSur Solutions • Reston, VA

14h

About The Position

TechSur Solutions is seeking a Senior Security Specialist with governance, risk, and compliance (GRC) expertise to lead Authority to Operate (ATO) work for a federal customer's new cloud services. The role guides customer cloud environments on AWS, Azure, Google Cloud, and Oracle Cloud through the NIST Risk Management Framework, from control mapping and System Security Plans to third-party assessment and continuous monitoring. The specialist works with cloud engineers, customer security teams, and Authorizing Officials to help ensure landing zones, pipelines, and shared services meet NIST SP 800-53 Rev. 5, FedRAMP, and customer security requirements and remain compliant in production.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field.
• At least 9 years of information security experience, including implementing and managing security controls and leading ATO efforts.
• Deep working knowledge of the NIST RMF (SP 800-37) and NIST SP 800-53 Rev. 5 control families.
• Hands-on experience writing SSPs and managing SAP/SAR and POA&M processes with a 3PAO or agency assessor.
• Experience performing continuous security assessments and monitoring in cloud environments.
• Strong technical writing skills and ability to brief senior government stakeholders.
• Ability to obtain and maintain the background investigation required by the federal customer.

Nice To Haves

• CISSP, CISM, CGRC (formerly CAP), CRISC, or CCSP certification.
• Experience with FedRAMP Moderate or High authorizations for multi-cloud environments.
• Experience with OSCAL-based security documentation and GRC platforms such as ServiceNow IRM/GRC, Xacta, or eMASS.
• Familiarity with agency-specific security frameworks built on NIST SP 800-53.
• Experience with CSPM tools and Splunk-based security monitoring.
• Prior support of a civilian federal agency.

Responsibilities

• Lead ATO preparation for cloud services under NIST SP 800-37 (RMF), NIST SP 800-53 Rev. 5, and FedRAMP Moderate/High processes.
• Develop and maintain System Security Plans, control implementation statements, Customer Responsibility Matrices, and CSP control-inheritance documentation.
• Coordinate with a Third-Party Assessment Organization (3PAO), including supporting Security Assessment Plans and Reports (SAP/SAR), gathering evidence, facilitating interviews, and responding to findings.
• Manage Plans of Action and Milestones (POA&Ms), tracking gaps, owners, and remediation dates in ServiceNow and helping engineering teams close findings.
• Run continuous monitoring with CSP-native and third-party tools and produce monthly compliance reports.
• Prioritize vulnerabilities using CVSS, exploitability, and customer risk ratings.
• Review architectures, IaC templates, and CI/CD pipelines for alignment with Zero Trust (NIST SP 800-207), CIS Benchmarks, and customer security standards.
• Help develop incident response playbooks mapped to MITRE ATT&CK and participate in tabletop exercises.
• Brief customer security leadership and present security posture at monthly Security & Compliance reviews.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior