Workstreet

Compliance

• Lead NIST SP 800-53 Control Implementation: Own and oversee the interpretation, mapping, and implementation of NIST SP 800-53 Rev 5 controls across Moderate and High baseline engagements, ensuring control narratives are accurate, defensible, and aligned to agency expectations.
• Own and Review FedRAMP/GovRAMP Authorization Documentation: Direct the development, quality review, and maintenance of System Security Plans (SSPs), control implementation narratives, POA&Ms, SAPs, SARs, CISOs, and continuous monitoring artifacts for FedRAMP and GovRAMP programs.
• Lead FedRAMP and GovRAMP Readiness Assessments: Lead gap analyses and readiness reviews that prepare clients for Agency ATO pathways, GovRAMP authorization, and the FedRAMP 20x continuous authorization model. Translate findings into actionable remediation roadmaps aligned to authorization milestones.
• Manage Authorization and Assessment Coordination: Serve as the primary engagement lead coordinating with Third-Party Assessment Organizations (3PAOs), Authorizing Officials (AOs), cloud service providers, and state agency stakeholders throughout the FedRAMP and GovRAMP authorization lifecycle.
• Boundary Definition & System Scoping: Lead FedRAMP and GovRAMP authorization boundary definition and system scoping activities, including in-scope component identification, interconnections, data flows, shared responsibility models, and leveraged authorization packages, ensuring alignment with FedRAMP PMO guidance and agency-specific requirements.
• Oversee Continuous Monitoring Programs: Direct and quality-assure monthly, quarterly, and annual FedRAMP and GovRAMP continuous monitoring requirements, including vulnerability management, incident response reporting, significant change requests, and annual assessment planning. Advise clients on automation tooling and OSCAL adoption aligned to FedRAMP 20x objectives.
• Drive FedRAMP 20x Readiness and Positioning: Serve as Workstreet’s internal subject matter expert on FedRAMP 20x, including machine-readable authorization packages (OSCAL), continuous authorization models, and emerging PMO pilot guidance. Educate clients and internal teams on implications and readiness pathways.
• Manage Client Relationships and Engagement Delivery: Own client-facing communication, milestone tracking, and escalation management across multiple concurrent FedRAMP, GovRAMP, and NIST 800-53 engagements. Ensure consistent delivery quality across the portfolio and serve as the primary point of escalation for client issues.
• Support Business Development and Solutioning: Contribute to proposals, scoping calls, and sales conversations for FedRAMP, GovRAMP, and NIST 800-53 opportunities. Help shape Workstreet’s go-to-market positioning for state and federal government compliance services.
• Lead, Coach, and Develop GRC Engineers: Directly manage and mentor a team of Senior and Junior GRC Engineers supporting federal compliance engagements. Provide hands-on technical coaching on NIST SP 800-53 control implementation, FedRAMP documentation standards, and 3PAO coordination. Conduct regular 1:1s, set performance expectations, review work products for quality and accuracy, and actively develop team members’ careers through structured feedback, stretch assignments, and knowledge-sharing sessions. Partner with Workstreet leadership on hiring, onboarding, and capacity planning as the federal practice grows.

Government Compliance Manager

Analyst

• Respond to Security Questionnaires : Complete security questionnaires and vendor risk assessments by leveraging existing documentation and established response frameworks.
• Research and Draft Responses : Research and provide accurate answers to client security and compliance questions using internal policies and control libraries.
• Reference Compliance Evidence : Retrieve and validate supporting evidence from platforms such as Drata, Vanta, or SecureFrame to substantiate responses.
• Collaborate with Internal Teams : Coordinate with compliance and security teams to verify information and ensure consistency across all submissions.
• Ensure Timely and Accurate Delivery : Finalize and submit all security documentation accurately, comprehensively, and within required deadlines.

Trust Services Analyst

Security Engineer

• Implement Cloud Security Controls: Apply and maintain security best practices across AWS, GCP, and Azure to ensure alignment with compliance and regulatory standards.
• Assess Cloud Environments: Evaluate client infrastructures to identify security risks, misconfigurations, and vulnerabilities, providing targeted remediation recommendations.
• Deploy and Manage Security Tools: Configure and maintain SIEM, IDS/IPS, vulnerability management, and identity solutions to strengthen cloud security posture.
• Support Compliance Initiatives: Contribute to SOC 2, ISO 27001, and HIPAA efforts through control implementation, testing, and evidence validation.
• Automate Security Operations: Develop and manage infrastructure-as-code (IaC) scripts to streamline and enforce consistent cloud security controls.
• Conduct Cloud Security Reviews: Perform architecture assessments and configuration reviews to ensure secure design and adherence to best practices.
• Collaborate with Engineering Teams: Integrate security practices into CI/CD pipelines and development workflows to prevent vulnerabilities early in the lifecycle.
• Assist in Incident Response: Investigate and remediate cloud-related security incidents to minimize exposure and restore integrity.
• Communicate with Clients: Engage directly with clients via multiple channels to address security inquiries and deliver actionable guidance.

Cloud Security Engineer

• Own the Client Experience: Serve as the dedicated primary contact for a portfolio of high-complexity, long-term client accounts, ensuring consistent delivery, proactive communication, and strong relationships at every stage of the engagement.
• Lead Client Engagements: Conduct regular client meetings, deliver progress updates, set expectations, and guide clients through audits, assessments, and compliance milestones with clarity and confidence.
• Communicate with Care: Engage directly with U.S.-based clients via phone, email, and text to address compliance concerns, provide expert guidance, and ensure clients always feel supported and informed.
• Handle Escalations: Resolve complex client issues swiftly and professionally, applying a solution-oriented approach that reinforces client trust and satisfaction.
• Be a Trusted Advisor: Build long-term relationships by understanding each client's unique business context and delivering compliance guidance that is practical, relevant, and actionable.
• Manage and Develop a Pod of Analysts: Provide day-to-day direction, constructive feedback, and professional development support to a small team of junior analysts, fostering a high-performance and collaborative culture.
• Drive Accountability: Ensure the pod delivers high-quality work on time across all active client engagements, stepping in to support and coach where needed.
• Interpret Regulatory Frameworks: Analyze and apply cybersecurity compliance requirements under SOC 2, ISO 27001, HIPAA, NIST CSF, and related standards.
• Lead Compliance Projects: Oversee multiple client engagements simultaneously, including audits, evidence collection, control mapping, and due diligence or incident response activities.
• Develop Compliance Programs: Create, implement, and maintain cybersecurity policies, procedures, and supporting documentation to meet audit and certification objectives.
• Collaborate on Risk Management: Work with internal and external teams to identify, assess, and mitigate cybersecurity and compliance risks.
• Drive Process Improvement: Enhance standard operating procedures, playbooks, and compliance frameworks to strengthen operational effectiveness.

Senior GRC Engineer

• Assist in implementing and maintaining cybersecurity compliance programs aligned with SOC 2, ISO 27001, and other regulatory standards.
• Develop and update cybersecurity policies, procedures, and control evidence to support audits and assessments.
• Work with internal and external teams to identify, track, and help remediate cybersecurity risks and control gaps.
• Support multiple compliance projects by managing documentation, timelines, and deliverables under senior guidance.
• Engage with clients via email, chat, and calls to gather evidence, clarify compliance requirements, and provide timely updates.
• Conduct basic control checks and assist in readiness reviews to ensure continuous compliance with internal and external standards.
• Partner with IT, security, and operations teams to implement corrective actions and strengthen compliance posture.
• Receive mentorship from senior team members and contribute to improving processes, templates, and playbooks for compliance delivery.

GRC Engineer I

• Interpret and Apply FedRAMP Requirements: Analyze and apply NIST SP 800-53 controls, FedRAMP baselines, and agency-specific requirements to ensure client compliance.
• Develop and Maintain FedRAMP Documentation: Develop and maintain System Security Plans (SSPs), control implementation narratives, POA&Ms, SAPs, SARs, and continuous monitoring artifacts.
• Conduct FedRAMP Readiness Assessments: Perform gap analyses and readiness reviews to prepare organizations for JAB or Agency ATO pathways.
• Support Authorization and Assessment Activities: Coordinate with Third-Party Assessment Organizations (3PAOs), cloud service providers, and government stakeholders throughout the FedRAMP lifecycle.
• Boundary Definition & Scoping: Perform CMMC/FedRAMP authorization boundary definition and system scoping activities.
• Support Continuous Monitoring Programs: Conduct monthly, quarterly, and annual FedRAMP continuous monitoring requirements.
• Support FedRAMP Engagements: Assist on multiple concurrent client projects.
• Support CMMC and NIST 800-171 Compliance Efforts: Assist defense contractors with interpreting CMMC 2.0 and NIST SP 800-171 controls and implementing compliant security programs.
• Develop CMMC Documentation: Contribute to SSPs, POA&Ms, and supporting artifacts required for CMMC Level 1 and Level 2 readiness.

GRC Engineer – CMMC, FedRAMP

QA Engineer

• Perform comprehensive security assessments across cloud, network, and system environments.
• Execute specialized security evaluations of native MacOS applications to identify platform-specific vulnerabilities.
• Go beyond standard assessments by simulating real-world adversary tactics and testing human security awareness through phishing and pretexting.
• Evaluate and exploit vulnerabilities within AWS, GCP, or Azure environments to ensure robust cloud architecture.
• Analyze findings, assess impact, and produce detailed reports with clear remediation recommendations.
• Work with engineering and operations teams to validate fixes and strengthen overall system security.
• Create and refine scripts, tools, and methodologies to enhance testing accuracy and coverage.
• Continuously monitor emerging exploits, specifically focusing on MacOS-based threats and cloud-native attack vectors.

Penetration Tester

Manager

• Lead and Mentor Teams: Supervise and coach two Project Managers and their respective Project Coordinators, ensuring performance alignment, collaboration, and professional growth.
• Client Portfolio Management: Oversee successful delivery of 15+ concurrent client projects, maintaining clear communication, prioritization, and escalation processes.
• Jira & Agile Expertise: Serve as the Jira and Agile SME—configure workflows, manage sprint cadences, maintain dashboards, and standardize Agile practices across teams.
• Metrics & Dashboard Reporting: Build and manage real-time dashboards and KPIs in Jira, Notion, or other reporting tools to monitor progress, productivity, and team performance.
• Operational Coordination: Collaborate with Security Analysts, Compliance Specialists, and cross-functional teams to ensure seamless delivery and consistent quality across engagements.
• Process Optimization: Identify operational gaps and implement scalable improvements through automation, templates, and standardized documentation.
• Stakeholder Communication: Provide timely updates, performance metrics, and risk assessments to the Senior Manager of Trust Services and leadership stakeholders.
• Tool Utilization: Leverage Slack, Notion, and other collaboration platforms for efficient communication, documentation, and workflow transparency.
• Timeline & Resource Management: Balance workloads, adjust priorities dynamically, and ensure all projects meet deadlines and quality expectations.
• 24x5 Operations Support: Oversee global team operations to maintain responsiveness and accountability across multiple time zones.

Manager, Trust Services

• Implement Cloud Security Controls : Apply and maintain security best practices across AWS, GCP, and Azure to ensure alignment with compliance and regulatory standards.
• Assess Cloud Environments : Evaluate client infrastructures to identify security risks, misconfigurations, and vulnerabilities, providing targeted remediation recommendations.
• Deploy and Manage Security Tools : Configure and maintain SIEM, IDS/IPS, vulnerability management, and identity solutions to strengthen cloud security posture.
• Support Compliance Initiatives : Contribute to SOC 2, ISO 27001, and HIPAA efforts through control implementation, testing, and evidence validation.
• Automate Security Operations : Develop and manage infrastructure-as-code (IaC) scripts to streamline and enforce consistent cloud security controls.
• Conduct Cloud Security Reviews : Perform architecture assessments and configuration reviews to ensure secure design and adherence to best practices.
• Collaborate with Engineering Teams : Integrate security practices into CI/CD pipelines and development workflows to prevent vulnerabilities early in the lifecycle.
• Assist in Incident Response : Investigate and remediate cloud-related security incidents to minimize exposure and restore integrity.
• Communicate with Clients : Engage directly with clients via multiple channels to address security inquiries and deliver actionable guidance.

Sales Operations Manager

• Create and prepare sales contracts using approved templates and pricing guidelines
• Process signed contracts by downloading, organizing, and storing them in Google Drive
• Complete deal closure processes in HubSpot, ensuring all required fields are accurately populated
• Maintain data integrity across HubSpot, Streetsmart, Airtable, and other internal systems
• Create preliminary proposals in Streetsmart (up to 70% completion) for Account Executive final review and customization
• Provide updates on deal observations, opportunity progression, and contract status
• Verify customer accounts in MSP Console on subscription start date from Order Form
• Review and confirm customer details, applicable frameworks, and company information are accurate in provisioned account
• Manage user access by adding/removing users and coordinating admin invitations for the Vanta instance
• Monitor and prevent duplicate deal creation within the CRM
• Conduct weekly audits to identify companies with contacts but no associated deals
• Review active customer contracts and validate key data points across HubSpot, Juro, and contract documents
• Review and ensure contract templates are updated in Juro; compile and track contract approval for redlines and negotiated terms
• Provide updates and conduct walkthroughs for stakeholders on processes, contract management workflows, and system changes

Sales Operations Analyst

Recruitment

• Lead full-cycle recruitment for cybersecurity roles including GRC analysts, compliance managers, and other related roles
• Source and vet candidates with deep knowledge of SOC 2, ISO 27001, NIST, and related security/compliance frameworks
• Collaborate with stakeholders to craft role requirements, scorecards, and interview processes
• Manage pipelines and reporting through Workstreet’s internal tools and ATS system (currently Rippling)
• Drive outreach strategies using LinkedIn, GitHub, referrals, and Workstreet’s growing candidate network
• Stay on top of trends in cloud security, regulatory compliance, and the cybersecurity talent landscape
• Promote Workstreet’s commitment to building high-performing teams.

Contract Recruiter

• Complete security questionnaires and vendor risk assessments using existing documentation.
• Research and respond to security questionnaires by leveraging policy and control libraries.
• Work within platforms like Drata, Vanta, or SecureFrame to retrieve relevant evidence.
• Collaborate with compliance and security teams to clarify responses as needed.

• Interpret and Apply FedRAMP Requirements: Analyze and apply NIST SP 800-53 controls, FedRAMP baselines, and agency-specific requirements to ensure client compliance.
• Develop and Maintain FedRAMP Documentation: Author and maintain System Security Plans (SSPs), control implementation narratives, POA&Ms, SAPs, SARs, and continuous monitoring artifacts.
• Conduct FedRAMP Readiness Assessments: Perform gap analyses and readiness reviews to prepare organizations for JAB or Agency ATO pathways.
• Support Authorization and Assessment Activities: Coordinate with Third-Party Assessment Organizations (3PAOs), cloud service providers, and government stakeholders throughout the FedRAMP lifecycle.
• Boundary Definition & Scoping: Lead CMMC/FedRAMP authorization boundary definition and system scoping activities.
• Manage Continuous Monitoring Programs: Oversee FedRAMP continuous monitoring requirements, including vulnerability management, incident response reporting, and change control.
• Lead FedRAMP Engagements: Manage multiple concurrent client projects, ensuring milestones, deliverables, and quality standards are consistently met or exceeded.
• Support CMMC and NIST 800-171 Compliance Efforts: Assist defense contractors with interpreting CMMC 2.0 and NIST SP 800-171 controls.

Senior GRC Engineer – CMMC/FedRAMP

Data Scientist

• Own the health, accuracy, and usability of data across our systems.
• Manage and maintain data integrity across HubSpot and connected platforms, ensuring records are clean, deduplicated, and up to date.
• Build and optimize HubSpot workflows, sequences, and automations to streamline operations and reduce manual processes.
• Create and maintain dashboards, reports, and recurring data pulls for stakeholders across sales, marketing, and leadership.
• Develop and enforce data governance standards, including naming conventions, property management, and lifecycle stage definitions.
• Audit and troubleshoot data issues proactively—catch problems before they compound.
• Own integrations between HubSpot and other tools in the stack (e.g., Zapier, Segment, spreadsheets, or internal databases).
• Support ad hoc data requests and analysis for cross-functional teams, translating raw data into clear, actionable insights.
• Document processes, SOPs, and system configurations so the team isn't reliant on tribal knowledge.

Data Manager

Collections

• Follow up with customers regarding late payments.
• Navigate a customer’s current standing through its sales, service, and delivery teams internally, to ensure we have the right contact and contact information.
• Work directly with the external Accounting team, learning how Accounting systems work and ensuring that internal systems are in line with external processes.
• Complete deal / Company record completeness in HubSpot, ensuring all required fields are accurately populated and up to date.
• Maintain data integrity across HubSpot, Streetsmart, Airtable, and other internal systems.
• Provide updates on customer observations, opportunity progression, and contract status.
• Process invoicing and submit accounting forms or billing adjustments.
• Review and confirm customer details, applicable frameworks, and company information.
• General data management projects – retroactive reviews, backfilling information, and updating lists of current customer statuses.

Government Compliance Manager

Trust Services Analyst

Cloud Security Engineer

Senior GRC Engineer

GRC Engineer I

GRC Engineer – CMMC, FedRAMP

Penetration Tester

Manager, Trust Services

Cloud Security Engineer

Sales Operations Analyst

Contract Recruiter

Trust Services Analyst

Senior GRC Engineer – CMMC/FedRAMP

Data Manager

Customer Collections Analyst