Senior GRC Consultant — Federal & Complex Frameworks

Lead delivery of FedRAMP readiness/authorization support, CMMC Level 1–3 assessments and gap remediation, HITRUST r2 validated assessment preparation, NIST 800-53/800-171 control implementation and SSP development, and NIST CSF maturity assessments.

Provide pre-sales technical validation on federal/complex opportunities — these deals typically need scoping rigor before contract that standard-framework deals don't.

Build and maintain control-mapping libraries, SSP templates, POA&M templates, and evidence-collection playbooks calibrated to the depth federal frameworks require.

Track framework revisions (NIST 800-53 Rev 6, CMMC rule finalization, FedRAMP 20x, etc.) and translate changes into playbook updates promptly — these frameworks move on regulatory timelines, not product timelines.

Define pricing for federal/complex engagements, reflecting higher complexity and duration than standard-framework work.

Own margin and utilization on your engagement book; forecast capacity against a specialized, harder-to-backfill skillset.

Build AI-assisted control-mapping and evidence-review playbooks, with heavier human-review gates than standard frameworks warrant given ATO/certification consequences.

Define QA guardrails specific to federal work: accuracy is non-negotiable given the downstream consequence (loss of certification/authorization eligibility).

Set clear boundaries/disclaimers on what Sprinto's assessment does and doesn't guarantee toward formal certification/authorization outcomes.

5+ years in federal/defense-adjacent compliance consulting, or as an ISSO/ISSM, FedRAMP 3PAO assessor, or CMMC C3PAO assessor.

Has taken systems through an actual ATO, FedRAMP authorization, or CMMC certification — advisory-only experience isn't sufficient here.

FedRAMP (Moderate/High baseline), CMMC L1–L3, HITRUST r2, NIST 800-53, NIST 800-171, NIST CSF.

OSCAL/SSP structural familiarity is a plus.

Demonstrated use of AI tools to reduce manual effort and standardize deliverables.

Able to translate domain expertise into reusable templates and guided systems.

Comfortable owning pricing and margin on a lower-volume, higher-ACV book.

Excellent written communication for SSP/POA&M-grade documentation.

Strong judgment under regulatory ambiguity.

CISSP, CISA, CMMC-RP/CMMC-CCA, FedRAMP-recognized assessor training, NIST 800-171 assessor certification.

Utilization % and gross margin on federal/complex engagements (benchmarked separately from standard frameworks — expect fewer, longer engagements).

Delivery cycle time and QA pass rate, calibrated to 6–12+ month authorization timelines rather than weeks.

Customer outcome rate (successful authorization/certification progression).

Deal-unblock impact on federal/regulated opportunities Sales/SE couldn't close without this expertise.

Stepping in before someone has to step up.

Wearing multiple hats without counting them.

Leaving egos at the door and winning as one team.

Taking the harder right over the easier wrong.

Shipping, learning, repeating.

Staying curious and never staying in your lane.

Work wherever you are: We are 100% remote, so you get to choose if you want to work from home, a cafe, the hills, or the beach.

Co-working, on the house: If co-working is your jam, we offer a generous annual allowance.

We care about your learning: We are invested in seeing you grow and commit USD 1,000 annually to help you level up your skills.

We count your spark, not your leaves: Unlimited leave so you can reset when you need to.

Your Safety Net, Woven In: Health insurance with coverage up to INR 10 lakh for you and your family, accident protection of an additional INR 10 lakh, and life insurance worth 3x your annual salary.

Workspace setup of your dreams: We chip in INR 35,000 to help you build a setup that works for you