[Hiring] GRC & Control Design Engineer @Sparix Global.

Role Description

This role owns the compliance architecture of a FedRAMP Vulnerability Detection & Response (VDR) program undergoing significant regulatory changes under the 2026 FedRAMP rules. The position is responsible for translating approximately 22 VDR/VER requirements into concrete, auditable controls, ensuring that tooling and processes satisfy 3PAO assessors and federal agencies.

The engineer will:

• Design evaluation rubrics.
• Define accepted-vulnerability workflows replacing POA&Ms.
• Author the complete documentation set, including policies and control narratives.
• Validate machine-readable FedRAMP JSON outputs.

The role sits at the intersection of Governance, Risk & Compliance (GRC), security compliance, and technical architecture, requiring both deep regulatory expertise and sufficient technical literacy to evaluate API outputs, JSON schemas, and system architecture decisions for compliance implications. The engineer will also support audit readiness and advise engineering teams on compliance impacts of implementation choices.

Qualifications

• 5+ years of experience in Governance, Risk & Compliance (GRC).
• Security Compliance.
• Audit roles.
• Direct FedRAMP experience.

Requirements

• Experience with Authorization to Operate (ATO) packages.
• System Security Plans (SSPs).
• Continuous Monitoring.
• 3PAO assessments.
• Deep understanding of vulnerability management compliance, including:
• Scanning requirements.
• Remediation SLAs.
• POA&M lifecycle.
• Risk acceptance and deviation processes.
• Proven experience designing implementable and testable security controls from regulatory requirements.
• Strong technical literacy with the ability to review:
• API outputs.
• JSON schemas.
• Architecture diagrams.
• Compliance validation.
• Excellent technical writing skills for:
• Policies.
• Control narratives.
• Audit documentation.
• Assessor-facing documentation.

Preferred (Bonus) Skills

• Working knowledge of FedRAMP 2026 VDR/VER rules.
• CISA BOD 26-04.
• Ability to quickly learn new regulatory frameworks.
• Experience with NIST SP 800-53.
• SSDF (Secure Software Development Framework).
• NIST SP 800-190 (Container Security).
• Prior experience with compliance-driven tooling migrations.
• Evidence automation initiatives.
• Familiarity with OSCAL (Open Security Controls Assessment Language).
• FedRAMP JSON schemas.