> Markdown version of [/jobs/ext/4661287-grc-lead](https://www.wearedevelopers.com/jobs/ext/4661287-grc-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # GRC Lead - **Company:** Nominal Inc - **Location:** Washington, DC, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Computer Engineering, Software Engineering - **Published:** November 10, 2026 - **Apply:** https://www.careerbuilder.com/job-details/grc-lead-washington-dc--7b96d18f-bcc4-4120-bb51-70252cbc08ad ## About the Role Robotics, Computer Engineering, Testing, Artificial Intelligence (AI), Software Engineering, System Operations, Manufacturing, United States Air Force (USAF), Aerospace and Defense, Technical Leadership, * Hands-on experience running compliance programs through audits, such as FedRAMP, SOC 2, CMMC, or CE+. * Working knowledge of control frameworks and how they map to each other, such as NIST 800-53, NIST 800-171, and the SOC 2 trust services criteria. * Experience turning gap analysis into a sequenced remediation plan with named owners and dates. * A track record of owning evidence collection and audit readiness, including working directly with assessors. * Enough technical fluency to talk with engineering, IT, and security teams about what a control means in practice and whether the evidence satisfies it. * Clear written and verbal communication when reporting status and risk to senior leaders. * The judgment to make calls amid competing priorities and to use escalation authority directly and calmly when owners miss commitments. Skills that supercharge us * Experience building a GRC function at a growth-stage software company, from first tracker to repeatable process. * Hands-on use of compliance automation or GRC tooling, such as Drata, Vanta, or similar platforms. * Familiarity with handling CUI and export-controlled data across cloud, on-prem, and air-gapped environments. * Background at a defense contractor or a software company selling to federal customers. ## Description Our customers, including programs within the U.S. Air Force and Navy, trust us with the data and controls behind their hardware, so our compliance posture has to hold up under outside scrutiny. Nominals programs span FedRAMP, SOC 2, CMMC, and Cyber Essentials Plus (CE+), each with its own controls, evidence, and assessors. GRC is the function that keeps all of them moving and gets them across the line. Were looking for a GRC Lead to own execution across every program. Youll hold a single view of where each framework stands, run the gap analysis and control uplift planning, and decide what gets fixed, in what order, and by whom. Youll also own the evidence tracker, drive task owners to closure, coordinate audit readiness and assessor logistics, and report compliance status to leadership. You are the execution owner, not a coordinator. Because the role takes program-management load off every technical lane, youll have visible escalation authority from day one. This is a high-ownership role for a GRC practitioner who has taken programs through real audits and knows that they pass when someone owns closure on every control, not when the tracker looks tidy. Youll shape which compliance problems we solve first and set the standard for how Nominal runs them. What youll do * Own a single view across FedRAMP, SOC 2, CMMC, and CE+, so leadership and every technical team know where each program stands and what is blocking it. * Run gap analysis and control uplift planning across frameworks, finding where one control satisfies several programs and where a new one is needed. * Sequence remediation across engineering, IT, and security, deciding what gets fixed when and by whom, and escalate when owners miss commitments. * Own the evidence tracker and drive task owners to closure ahead of every audit window. * Coordinate audit readiness and assessor logistics for each program, from scoping and walkthroughs through findings response. * Report compliance status to leadership with clear risks, owners, and dates. * Define how the programs run day to day, so task owners know what is expected and no program depends on one person.