Workstreet

Compliance

• Analyze and interpret CMMC requirements and NIST SP 800-171 controls to ensure client compliance with Department of Defense cybersecurity standards.
• Develop, implement, and maintain System Security Plans (SSPs), Plans of Action & Milestones (POA&Ms), and other CMMC-required documentation.
• Conduct gap assessments and readiness reviews for organizations pursuing CMMC certification.
• Collaborate with defense contractors to identify and remediate gaps in their cybersecurity programs to meet CMMC Level 1 and Level 2 requirements.
• Guide clients through the CMMC assessment process and coordinate with Certified Third-Party Assessment Organizations (C3PAOs).
• Manage and coordinate multiple CMMC compliance projects across various defense contractors, ensuring timely completion before contract deadlines.
• Lead and mentor a small team of compliance professionals to effectively deliver on CMMC objectives.
• Stay current with evolving CMMC requirements, CMMC 2.0 rulemaking, and DoD cybersecurity policies.

Senior GRC Engineer – Government

• Lead NIST SP 800-53 Control Implementation: Own and oversee the interpretation, mapping, and implementation of NIST SP 800-53 Rev 5 controls across Moderate and High baseline engagements, ensuring control narratives are accurate, defensible, and aligned to agency expectations.
• Own and Review FedRAMP/GovRAMP Authorization Documentation: Direct the development, quality review, and maintenance of System Security Plans (SSPs), control implementation narratives, POA&Ms, SAPs, SARs, CISOs, and continuous monitoring artifacts for FedRAMP and GovRAMP programs.
• Lead FedRAMP and GovRAMP Readiness Assessments: Lead gap analyses and readiness reviews that prepare clients for Agency ATO pathways, GovRAMP authorization, and the FedRAMP 20x continuous authorization model. Translate findings into actionable remediation roadmaps aligned to authorization milestones.
• Manage Authorization and Assessment Coordination: Serve as the primary engagement lead coordinating with Third-Party Assessment Organizations (3PAOs), Authorizing Officials (AOs), cloud service providers, and state agency stakeholders throughout the FedRAMP and GovRAMP authorization lifecycle.
• Boundary Definition & System Scoping: Lead FedRAMP and GovRAMP authorization boundary definition and system scoping activities, including in-scope component identification, interconnections, data flows, shared responsibility models, and leveraged authorization packages, ensuring alignment with FedRAMP PMO guidance and agency-specific requirements.
• Oversee Continuous Monitoring Programs: Direct and quality-assure monthly, quarterly, and annual FedRAMP and GovRAMP continuous monitoring requirements, including vulnerability management, incident response reporting, significant change requests, and annual assessment planning. Advise clients on automation tooling and OSCAL adoption aligned to FedRAMP 20x objectives.
• Drive FedRAMP 20x Readiness and Positioning: Serve as Workstreet’s internal subject matter expert on FedRAMP 20x, including machine-readable authorization packages (OSCAL), continuous authorization models, and emerging PMO pilot guidance. Educate clients and internal teams on implications and readiness pathways.
• Manage Client Relationships and Engagement Delivery: Own client-facing communication, milestone tracking, and escalation management across multiple concurrent FedRAMP, GovRAMP, and NIST 800-53 engagements. Ensure consistent delivery quality across the portfolio and serve as the primary point of escalation for client issues.
• Support Business Development and Solutioning: Contribute to proposals, scoping calls, and sales conversations for FedRAMP, GovRAMP, and NIST 800-53 opportunities. Help shape Workstreet’s go-to-market positioning for state and federal government compliance services.
• Lead, Coach, and Develop GRC Engineers: Directly manage and mentor a team of Senior and Junior GRC Engineers supporting federal compliance engagements. Provide hands-on technical coaching on NIST SP 800-53 control implementation, FedRAMP documentation standards, and 3PAO coordination.

Compliance Manager – Government

QA Engineer

• Perform comprehensive security assessments across cloud, network, and system environments.
• Execute specialized security evaluations of native MacOS applications to identify platform-specific vulnerabilities.
• Go beyond standard assessments by simulating real-world adversary tactics and testing human security awareness through phishing and pretexting.
• Evaluate and exploit vulnerabilities within AWS, GCP, or Azure environments to ensure robust cloud architecture.
• Analyze findings, assess impact, and produce detailed reports with clear remediation recommendations.
• Work with engineering and operations teams to validate fixes and strengthen overall system security.
• Create and refine scripts, tools, and methodologies to enhance testing accuracy and coverage.
• Continuously monitor emerging exploits, specifically focusing on MacOS-based threats and cloud-native attack vectors.

Penetration Tester

Manager

• Own Executive-Level Client Relationships: Serve as the senior point of contact for a portfolio of strategic accounts, building long-term trust and ensuring clients receive an exceptional, high-touch experience at every stage of the engagement.
• Lead and Guide Client Engagements: Provide strategic oversight across multiple trust services engagements, ensuring clients are well-informed, prepared, and confident throughout security reviews, assessments, and contractual negotiations.
• Manage Escalations at the Executive Level: Address complex, high-stakes client concerns with professionalism, urgency, and composure — turning challenging situations into opportunities to reinforce trust and loyalty.
• Be a Strategic Trusted Advisor: Understand the broader business goals of each client and deliver security and compliance guidance that is not just technically sound, but strategically aligned with their objectives.
• Conduct regular reviews of client communications, deliverables, and quality metrics to maintain consistency and excellence across all engagements.
• Supervise and mentor managers, analysts, and reviewers across multiple time zones, fostering a culture of performance, accountability, collaboration, and professional growth.
• Provide leadership and direction to team managers, setting clear expectations, coaching for performance, and ensuring accountability across the full delivery team.
• Drive staffing, hiring, and resource allocation to optimize delivery efficiency and support department scalability as the business grows.
• Establish and enforce quality benchmarks across the team, ensuring every client-facing output meets Workstreet’s high standards.
• Implement agile practices (Scrum or Kanban) to manage workload distribution, track SLAs, and drive continuous improvement through retrospectives and sprint planning.
• Oversee the completion, review, and finalization of client and vendor security questionnaires (SIG, CAIQ, or custom formats). Collaborate with SMEs to validate technical and compliance responses.
• Conduct and manage reviews of NDAs, DPAs, MNDAs, and other contractual security clauses. Collaborate with internal and external legal counsel to redline, comment, and ensure alignment with cybersecurity frameworks and risk posture.
• Utilize AI-powered tools to accelerate first-pass reviews and integrate SME feedback to improve accuracy and speed.
• Partner with Legal, Compliance, IT, and Sales teams to align responses, ensure contractual compliance, and resolve escalations.

Senior Manager, Trust Services

• Own the Client Experience: Serve as the dedicated primary contact for a portfolio of high-complexity, long-term client accounts, ensuring consistent delivery, proactive communication, and strong relationships at every stage of the engagement.
• Lead Client Engagements: Conduct regular client meetings, deliver progress updates, set expectations, and guide clients through audits, assessments, and compliance milestones with clarity and confidence.
• Communicate with Care: Engage directly with U.S.-based clients via phone, email, and text to address compliance concerns, provide expert guidance, and ensure clients always feel supported and informed.
• Handle Escalations: Resolve complex client issues swiftly and professionally, applying a solution-oriented approach that reinforces client trust and satisfaction.
• Be a Trusted Advisor: Build long-term relationships by understanding each client's unique business context and delivering compliance guidance that is practical, relevant, and actionable.
• Manage and Develop a Pod of Analysts: Provide day-to-day direction, constructive feedback, and professional development support to a small team of junior analysts, fostering a high-performance and collaborative culture.
• Drive Accountability: Ensure the pod delivers high-quality work on time across all active client engagements, stepping in to support and coach where needed.
• Interpret Regulatory Frameworks: Analyze and apply cybersecurity compliance requirements under SOC 2, ISO 27001, HIPAA, NIST CSF, and related standards.
• Lead Compliance Projects: Oversee multiple client engagements simultaneously, including audits, evidence collection, control mapping, and due diligence or incident response activities.
• Develop Compliance Programs: Create, implement, and maintain cybersecurity policies, procedures, and supporting documentation to meet audit and certification objectives.
• Collaborate on Risk Management: Work with internal and external teams to identify, assess, and mitigate cybersecurity and compliance risks.
• Drive Process Improvement: Enhance standard operating procedures, playbooks, and compliance frameworks to strengthen operational effectiveness.

Senior GRC Engineer

Security Engineer

• Manage 10–15+ concurrent client engagements, ensuring timely execution, prioritization, and risk management.
• Partner with Security Analysts, Compliance Specialists, and other internal teams to maintain quality and streamline workflows.
• Configure Jira boards, manage sprints, maintain dashboards, and promote consistent Agile practices.
• Build and maintain dashboards and KPIs in Jira, Notion, or similar tools to track project health and performance.
• Provide regular project updates, risks, and status reports to stakeholders and leadership.
• Identify gaps and implement improvements through documentation, templates, automation, and optimized workflows.
• Coordinate tasks, manage priorities, and ensure on-time delivery across multiple time zones.
• Use Slack, Notion, and other platforms to document work, improve transparency, and support operations.
• Maintain project continuity across shifts and ensure responsiveness during core hours.

Project Manager, Security Questionnaire

• Engineer Security via IaC: Design and maintain reusable Terraform modules for IAM, networking, and logging.
• Build Cloud Architecture: Deploy and manage AWS multi-account structures and Azure Hub-Spoke/Landing Zone architectures.
• Own Identity & Access: Implement least-privilege IAM and automate identity lifecycles.
• Direct Remediation: Own the remediation of vulnerabilities through engineering changes and patch automation.
• Automate Security Ops: Develop automated remediation workflows.
• Configure Native Security Stacks: Implement AWS GuardDuty, Azure Sentinel, etc.
• Network & Encryption Engineering: Design VPCs, security groups, and implement WAFs.
• Technical Compliance Implementation: Hands-on implementation of NIST 800-53 controls.

Senior Cloud Security Engineer

Software Engineer

• Own Executive-Level Client Relationships: Serve as the senior point of contact for a portfolio of strategic accounts
• Lead and Guide Client Engagements: Provide strategic oversight of multiple compliance engagements
• Manage Escalations at the Executive Level: Address complex client concerns with professionalism and urgency
• Be a Strategic Trusted Advisor: Deliver compliance guidance aligned with broader business goals
• Ensure Quality Across All Client Touchpoints: Conduct regular reviews of client communications and deliverables
• Lead and Develop a High-Performing Team: Supervise and mentor managers and analysts
• Drive Resource Strategy: Guide staffing, hiring, and resource allocation
• Set and Uphold Standards: Establish and enforce quality benchmarks across the team
• Oversee Compliance Programs: Manage and coordinate multiple cybersecurity compliance engagements
• Implement Compliance Policies: Develop, execute, and maintain cybersecurity compliance policies
• Collaborate on Risk Mitigation: Partner to identify, assess, and remediate cybersecurity risks
• Interpret Regulatory Frameworks: Analyze and apply cybersecurity regulations and standards

Senior Manager, GRC Engineering

• Own the Client Experience: Serve as the primary point of contact for a portfolio of client accounts, building strong, trusted relationships and ensuring clients feel supported, informed, and valued throughout every engagement.
• Lead Client Engagements: Guide clients through compliance initiatives end-to-end — from kickoff through certification — providing clear communication, proactive updates, and expert guidance at every milestone.
• Handle Escalations with Professionalism: Resolve complex client issues and requests with urgency, composure, and a solution-oriented approach that reinforces confidence and long-term retention.
• Be a Trusted Advisor: Understand each client's unique business context and deliver compliance guidance that is practical, actionable, and tailored to their needs.
• Collaborate Cross-Functionally: Partner with internal teams and client stakeholders to embed security and compliance best practices and resolve issues quickly.
• Manage and Develop a Pod of Analysts: Lead a team of 3–5 analysts through coaching, mentorship, and performance management, fostering accountability, quality, and professional growth.
• Drive Consistent Delivery: Ensure the team meets deadlines and delivers high-quality work across all active client engagements, stepping in to support where needed.
• Develop and Maintain Compliance Frameworks: Create, update, and align compliance policies, procedures, and technical controls with SOC 2 (Type 1 & 2), ISO 27001, HIPAA, and PCI DSS standards.
• Lead Compliance Certifications: Oversee and execute SOC 2 and ISO 27001 implementation and certification projects across multi-cloud environments (AWS, GCP, Azure).
• Conduct Risk and Security Audits: Perform regular risk assessments and audits to identify vulnerabilities and enhance overall security posture.
• Monitor Regulatory Developments: Stay informed on evolving regulations and frameworks to maintain the relevance and accuracy of compliance controls.
• Leverage Compliance Automation Tools: Utilize platforms such as Drata, Vanta, and SecureFrame to track compliance metrics and ensure continuous audit readiness.