> Markdown version of [/jobs/ext/1248609-senior-fedramp-consultant-grc-analyst-iii](https://www.wearedevelopers.com/jobs/ext/1248609-senior-fedramp-consultant-grc-analyst-iii). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior FedRAMP Consultant (GRC Analyst III) - **Company:** C2 Labs, Inc - **Location:** United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Microsoft Word, Microsoft Excel, JIRA, Microsoft Azure, Cloud Computing, Cloud Computing Security, Cloud Engineering, Cyber Security, Issue Tracking Systems, Microsoft Visio, Lucidchart, Smartsuite, Management of Software Versions, Servicenow, Plan of Action and Milestones - **Published:** July 12, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=3e8913e63dfa1d39 ## About the Role * 5+ years experience in GRC/compliance, security documentation, or audit support roles. * Security certification (CISSP, CISM, CCSP) * Demonstrated technical writing capability: can produce clear, consistent narratives for complex systems and controls. * Working knowledge of NIST 800-53 controls and evidence expectations; familiarity with FedRAMP package structure and templates. * Comfort collaborating with engineers and architects to accurately describe technical implementations. * Strong attention to detail (templates, cross-references, tables, and evidence mapping). Preferred / nice to have * Bachelors degree in IT, Cybersecurity, or related field * Prior experience drafting FedRAMP SSPs and/or supporting artifacts (Low/Moderate/High). * Experience with FedRAMP 20X concepts (KSIs, validation cycles, automation-first evidence). * Experience working in RegScale or similar GRC tools. * Audit-related experience. Tools & environment * RegScale (controls/KSIs, evidence, workflows, POA&M management) * Microsoft Word/Excel (FedRAMP templates), Visio/Lucidchart (diagrams) as available * Ticketing systems for remediation tracking (Jira/Azure DevOps/ServiceNow as customer uses) Engagement details * 1099 independent contractor (initial engagement); project-based with potential extension into ConMon operations. * Remote-first; occasional workshops may be requested (typically minimal travel). * No clearance required; must be able to pass a standard background check and sign NDA/SOW. * Hours scale with customer phase (heavy during package drafting; lighter during steady-state ConMon). ## Description * Lead drafting of FedRAMP artifacts (20X KSI summaries and/or legacy SSP/policies/plans) and drive iterations to completion. * Maintain control/KSI-to-evidence traceability in RegScale and keep the evidence library audit-ready. * Partner with cloud architecture/security engineering resources to ensure technical accuracy. * Support assessor/sponsor readiness: walkthroughs, responses, and updates., * Lead customer interviews/workshops to capture system boundary, data flows, shared responsibility model, and control/KSI implementations. * Draft and iterate FedRAMP artifacts (e.g., 20X KSI implementation summaries and/or legacy SSP sections, policies, and plans). * Build and maintain traceability between controls/KSIs, evidence, validation methods, and ConMon cadence in RegScale. * Coordinate evidence collection and organize artifacts into a clean evidence library aligned to the package structure. * Partner with the Cloud Architect and Security Engineer to ensure technical accuracy of narratives and diagrams. * Support assessment readiness: conduct package walkthroughs, respond to questions, and update artifacts based on feedback. * Mentor Junior Consultants on writing standards, template fidelity, and evidence hygiene. Key deliverables / outputs * FedRAMP first drafts of major package artifacts (KSI summaries and/or SSP sections). * Policy and plan artifacts aligned to FedRAMP expectations (e.g., IRP, CP, CMP, ISCM, Rules of Behavior as required). * Control/KSI-to-evidence traceability in RegScale with validation cadence documented. * Assessment-ready evidence library with consistent naming/versioning and completeness checks. ## Related Videos - [Improving quality with Agentic AI with Rovo Dev and Xray](https://www.wearedevelopers.com/videos/2005-improving-quality-with-agentic-ai-with-rovo-dev-and-xray) - [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) - [Collaboration Quantified: Lessons from Open Source Developer Networks](https://www.wearedevelopers.com/videos/1422-collaboration-quantified-lessons-from-open-source-developer-networks) - [Great DevEx and Regulatory Compliance - Possible?](https://www.wearedevelopers.com/videos/1426-great-devex-and-regulatory-compliance-possible) - [SRE Methods In an Agency Environment](https://www.wearedevelopers.com/videos/348-sre-methods-in-an-agency-environment) - [Integrate your Cognitive Assistant with 3rd-party DBs and software](https://www.wearedevelopers.com/videos/249-integrate-your-cognitive-assistant-with-3rd-party-dbs-and-software) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Résumé-Driven Development: How IT trends affect the job market for software developers](https://www.wearedevelopers.com/magazine/59-resume-driven-development-how-it-trends-affect-the-job-market-for-software-developers) - [A call for Guest Writers for the WeAreDevelopers Magazine](https://www.wearedevelopers.com/magazine/648-a-call-for-guest-writers-for-the-wearedevelopers-magazine) - [What Makes WeAreDevelopers World Congress Different From Every Other Tech Event?](https://www.wearedevelopers.com/magazine/701-what-makes-wearedevelopers-world-congress-different-from-every-other-tech-event)