Program Architect

What You’ll Do

• Own the design and implementation of Onebrief's GRC framework across RMF, FedRAMP, CMMC, SOC 2, and other applicable standards.
• Build and manage the control environment, including policies, procedures, and evidence collection systems.
• Design and implement technical security controls in partnership with Product, Engineering, Infrastructure and Corporate IT including access management, logging, encryption, and vulnerability management practices.
• Partner with Engineering, Infrastructure, and Corporate IT to translate compliance requirements into working technical controls, not just documented ones.

Minimum Qualifications

• 5+ years of experience in GRC, security engineering, or a combined compliance and technical security role
• Direct experience with RMF, FedRAMP, CMMC, or equivalent federal compliance frameworks
• Hands-on experience implementing technical security controls, such as IAM, logging and monitoring, network segmentation, or encryption
• Working knowledge of security control frameworks such as NIST 800-53 or NIST 800-171
• Experience managing third-party audits and assessor relationships
• Strong written communication skills, with the ability to translate regulatory language into clear technical and internal guidance

Preferred Qualifications

• Experience in a startup or scaling company environment
• Background in military, defense, or government contracting
• Relevant certifications, such as CISSP, CISA, CRISC, or a technical security certification (AWS Solutions Architect)
• Experience building GRC automation using infrastructure-as-code or scripting

Indicators of Success

• Identify and remediate at least one significant security control gap before it surfaces in an external audit
• Serve as the trusted point of contact for customer security questionnaires and compliance inquiries
• Be recognized by engineering and security teams as a partner who makes compliance workable and technically sound, not just another gate to pass
• Win buy-in from engineering leads who previously treated compliance requests as low priority
• Get through a customer or third-party security review without escalations or fire drills

Tools, Systems & Technologies

• GRC platforms (such as RegScale, eMASS, or similar)
• Cloud security tooling relevant to Federal environments
• Logging systems
• CI/CD pipelines
• Infrastructure-as-code for control automation