• Execute FedRAMP 20x control validation - analyze and apply FedRAMP Consolidated Rules (CR26) and the 46 Key Security Indicators (KSIs) across 10 families to ensure software architectures align with federal standards.
• Author machine-readable certification artifacts - create, update, and maintain Security Decision Records, Security Configuration Guides, and OSCAL/JSON/YAML documentation conforming to RFC-0024 and OMB M-24-15 mandates.
• Implement automated evidence pipelines - design and maintain automated evidence-gathering workflows to continuously validate KSIs, moving away from manual point-in-time audit procedures.
• Conduct readiness and gap assessments - perform technical readiness reviews and control mapping across FedRAMP 20x Class A, Class B, and Class C baseline requirements.
• Support Collaborative Continuous Monitoring (CCM) - assist in connecting CSPM and GRC tooling into agency pipelines to feed real-time KSI validation data.
• Facilitate external 3PAO assessments - coordinate evidence submission and operational logistics during Third-Party Assessment Organization (3PAO) audits and independent assessments under senior guidance.
• Assist in security control remediation - collaborate with internal and client technical teams to remediate security gaps and control deficiencies across multi-cloud environments.
• Track evolving federal regulatory updates - monitor CR26 updates, Significant Change Notifications (SCNs), and the Rev5-to-20x transition timeline to keep client programs aligned.

• Federal compliance practitioner - bring 2+ years of direct technical experience executing GRC deliverables across NIST SP 800-53, FedRAMP, or federal authorization lifecycles.
• FedRAMP 20x framework familiarity - foundational understanding of FedRAMP 20x Program Certifications (Class A/B/C), CR26 rules, and KSI-based validation models.
• Machine-readable artifact author - hands-on experience creating or working with technical compliance artifacts utilizing OSCAL, JSON, or YAML schemas.
• Sovereign cloud environment navigator - practical exposure to major cloud platforms (AWS, Azure, GCP) and secure government environments like AWS GovCloud or Azure Government.
• Compliance-as-code contributor - working ability with scripting languages or policy-as-code tools (Python, Rego/OPA, Terraform) to help build and inspect automated evidence pipelines.
• Disciplined project operator - highly organized practitioner with the ability to coordinate multiple federal compliance tasks concurrently without losing detail.
• Effective client communicator - possesses strong written and verbal English communication skills suited for direct collaboration with client technical teams and assessors.

What will help you succeed

• Active security credentials - hold recognized certifications such as CompTIA Security+, CGRC, CAP, or Associate of CISSP.
• Cloud infrastructure certifications - technical certifications such as AWS Solutions Architect Associate, Azure Security Engineer Associate, or GCP Associate Cloud Engineer.
• Direct 3PAO assessment exposure - practical history participating in 3PAO audits or supporting live agency Authority to Operate (ATO) evaluations.
• Collaborative continuous monitoring experience - background supporting FedRAMP ConMon or real-time Collaborative Continuous Monitoring (CCM) workflows.
• Complementary defense framework knowledge - baseline familiarity with CMMC 2.0 or NIST SP 800-171 requirements for defense supply chain contractors.

• Career Development : Clear path with mentorship and training opportunities.
• Role-Related Training: Reimbursement for the successful completion of approved training and certification courses relevant to your current role.
• Competitive Compensation: A competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities.
• Growth Opportunity : Early-stage company with significant room for career advancement.
• Remote-First Culture : Flexibility to work from anywhere while collaborating with a global team.

What You'll Need to Thrive

• Excellent written and verbal English communication skills, with the ability to engage confidently with candidates, hiring managers, and business leaders across global teams.
• A reliable, high-speed internet connection and a professional home office environment that supports confidential conversations, virtual interviews, and uninterrupted collaboration.
• Commitment to working a standard schedule of 8:00 AM–5:00 PM US Eastern Time (ET) to effectively support hiring managers, candidates, and cross-functional teams. Occasional flexibility to adjust working hours is expected to accommodate changing business priorities, global collaboration, and time-sensitive hiring needs.
• Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities as needed.

Hiring and Selection Process

• Candidates must participate in live video interviews throughout the hiring process with camera on (non-negotiable) and be prepared to verify their identity during recruitment and onboarding.
• Employment is contingent upon successful completion of identity verification and background screening, where permitted by law.
• Selected candidates will participate in structured interviews with hiring managers and cross-functional stakeholders to assess role fit, experience, and alignment with Workstreet’s operating principles.
• Candidates will receive prompt updates and consistent communication throughout the interview process, ensuring a transparent, smooth, and engaging experience at every step.
• Applicants must be authorized to work in the U.S. without the need for visa sponsorship now or in the future. Workstreet does not provide employment-based visa sponsorship or transfers for this role, including H-1B, L-1, TN, O-1, E-3, H-1B1, F-1 (OPT/CPT), J-1, or any other work-authorized visa category.

About Workstreet

At Workstreet , we’re on an exciting journey to help businesses scale securely by designing and implementing cutting-edge security and compliance programs. As a fast-growing startup, we specialize in a wide range of GRC (governance, risk, and compliance) services that support frameworks across SOC 2, ISO 27001, GDPR, CMMC, NIST 800-171, NIST 800-53, and FedRAMP. We empower companies to meet regulatory requirements and enhance their cybersecurity posture from day one.