{"id":2432626,"url":"https://alion.io/job/datalockcg-senior-grc-engineer","title":"Senior GRC Engineer","company":{"id":4423370,"name":"page","domain":"datalockcg.com","url":"https://alion.io/company/datalockcg","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Zoho Recruit","truth_index":null},"role":"Enterprise Apps","role_family":"Enterprise Apps","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":69000,"max_usd":163000,"period":"year","method":"global_role_seniority_cell","sample_n":1211},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"CVSS","optional":false},{"name":"FedRAMP","optional":false},{"name":"GitHub","optional":false},{"name":"Machine Learning","optional":false},{"name":"MuleSoft","optional":false},{"name":"NIST CSF","optional":false},{"name":"PKI","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false},{"name":"Zero Trust","optional":false},{"name":"Apex","optional":true}],"status":"live","first_seen_at":"2026-10-13T09:44:59Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-14T01:25:56Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"This is a remote position.\nThe Senior GRC Engineer is a seasoned cybersecurity professional responsible for maintaining and advancing the cybersecurity posture of a federal program, system, or enclave. This role operates at the intersection of cybersecurity, engineering, and risk management and is designed for an experienced practitioner who applies engineering rigor to develop high-quality, technically sound, and actionable security artifacts.\nThis position goes beyond static compliance and documentation. The Senior GRC Engineer guides system and engineering teams in designing, developing, implementing, and maintaining secure solutions aligned with evolving mission needs and threat environments. While the role produces documentation in support of the NIST Risk Management Framework, the emphasis is on meaningful security engineering outcomes rather than technical writing alone.\nThe Senior GRC Engineer champions the organization’s transition to a modern GRC Engineering model by promoting continuous assurance, automated evidence collection, integrated risk scoring, and scalable control inheritance. The role supports modernization initiatives, including DevSecOps, Zero Trust architectures, supply chain risk management, artificial intelligence and machine learning enabled security, responsible citizen development, and cybersecurity across both IT and operational technology environments.\nThrough leadership and technical expertise, this role strengthens system resilience, improves risk-based decision making, and accelerates secure mission delivery across federal environments.\nResponsibilities\nMaintain and strengthen the cybersecurity posture of assigned federal programs, systems, or enclaves.\nGuide system owners, ISSOs, and engineering teams in applying GRC engineering principles throughout the system lifecycle.\nLead and support Risk Management Framework activities, including system categorization, control selection, implementation, assessment, authorization, and continuous monitoring.\nProduce high-quality security and privacy artifacts that are technically sound, actionable, and aligned with engineering realities.\nSupport achievement and maintenance of Authorities to Operate (ATOs) and manage associated Plans of Action and Milestones (POA&Ms).\nBrief senior leadership on risk posture, authorization status, and remediation strategies.\nApply DevSecOps principles to integrate security into CI/CD pipelines and modern development workflows.\nSupport Zero Trust architecture implementation, supply chain risk management, and modernization initiatives.\nApply continuous integration, continuous delivery, and continuous security principles across environments.\nSupport implementation and analysis of SAST, DAST, Software Composition Analysis, secrets management, and GitHub-based workflows.\nApply Infrastructure as Code, virtualization, and containerization concepts to security engineering and assessment activities.\nUtilize endpoint protection, integrity monitoring, and SIEM tooling to support security operations and monitoring.\nImplement and assess authentication, authorization, and identity federation mechanisms including SAML, OAuth, and OIDC.\nApply PKI, encryption technologies, and FIPS implementation requirements.\nAnalyze network architectures, topologies, and protection mechanisms to assess confidentiality, integrity, and availability risks.\nLeverage OSCAL for machine-readable control catalogs, baselines, System Security Plans, and assessment documentation.\nAnalyze and interpret software vulnerabilities using CVE, CWE, and CVSS scoring methodologies.\nEvaluate supplier and product trustworthiness as part of supply chain risk management efforts.\nDevelop and maintain cybersecurity and privacy policies aligned with organizational objectives.\nApply cybersecurity and privacy principles related to confidentiality, integrity, availability, authentication, and non-repudiation.\nAssess security and privacy controls using frameworks such as NIST SP 800-53, the NIST Cybersecurity Framework, and CIS Critical Security Controls.\nDetermine how security systems should function, including resilience and dependability, and assess how environmental or operational changes affect system risk.\nCommunicate technical findings clearly and effectively through written documentation and stakeholder engagement.\nIntroduce automation, engineering practices, and innovation into GRC programs to improve efficiency and continuous monitoring maturity.\nRequirements\nRequired Qualifications\nBachelor’s degree in Computer Science, Information Systems, or a related field, or an additional three years of relevant experience.\nSeven or more years of relevant cybersecurity experience.\nThree or more years of experience serving as an ISSO for a Federal agency.\nPrior experience serving as an ISSO for a portfolio of Federal systems.\nExperience achieving ATOs, managing POA&Ms, and briefing senior leadership.\nDeep functional and technical knowledge of NIST RMF and NIST CSF processes and documentation.\nExpertise in FedRAMP standards and processes.\nStrong understanding of IaaS, PaaS, and SaaS cloud service models, including Azure, Microsoft 365, Salesforce, ServiceNow, Appian, and MuleSoft.\nStrong foundational and operational knowledge of DevSecOps, CI/CD pipelines, Zero Trust, supply chain risk management, artificial intelligence, and operational technology.\nFamiliarity with SAST, DAST, Software Composition Analysis, secrets management, and GitHub.\nOperational knowledge of Infrastructure as Code, virtualization, and containerization.\nProficiency with endpoint protection, integrity monitoring, and SIEM tools.\nExpertise in authentication, authorization, and identity federation technologies.\nFamiliarity with PKI, encryption technologies, and FIPS requirements.\nFoundational understanding of network architectures and security mechanisms.\nFamiliarity with OSCAL and machine-readable security documentation.\nAbility to analyze software vulnerabilities using CVE, CWE, and CVSS.\nExperience in technical writing and producing clear, well-organized security documentation.\nExperience evaluating supplier and product trustworthiness.\nPreferred Qualifications\nOne or more certifications such as CASP, GPEN, GMON, GISP, GSEC, GSLC, CISM, CISA, CAP, CCSP, SSCP, CISSP, or CISSP-ISSMP.\nExperience implementing policy as code to automate control enforcement, compliance validation, and evidence collection.\nDemonstrated ability to introduce automation and engineering practices into GRC programs to enhance efficiency and continuous monitoring.\nClearance\nAbility to obtain a Public Trust clearance is required.\nBenefits\nWorking at DataLock Consulting Group\nDataLock Consulting Group is a trusted cybersecurity and risk management firm supporting federal and public sector clients with high-impact security engineering, assessment, and compliance services. We offer competitive compensation, a comprehensive benefits package, and a strong commitment to work-life balance. Our team operates in a collaborative, remote-first environment that values technical excellence, professional growth, and delivering meaningful security outcomes for mission-critical systems","description_format":"text","description_chars":7185,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Compliance"],"lifecycle":[{"event":"open","at":"2026-10-13T09:44:59Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":29,"reasons":["conf:1","win:early"],"computed_at":"2026-10-14T03:14:05Z"},"pay":null,"html_url":"https://alion.io/job/datalockcg-senior-grc-engineer","json_url":"https://alion.io/job/datalockcg-senior-grc-engineer.json","meta":{"generated_at":"2026-10-14T03:14:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5042,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4423370},"rest":"https://alion.io/mcp/rest/get_company?id=4423370"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdatalockcg-senior-grc-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdatalockcg-senior-grc-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdatalockcg-senior-grc-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/datalockcg-senior-grc-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdatalockcg-senior-grc-engineer"}]}