Senior GRC Implementation Engineer (FedRAMP / SOC 2)

About the role

Turn control frameworks into working configuration. You will own the technical implementation of FedRAMP High and SOC 2 Type II controls across our proprietary SaaS and managed landing zones, and produce the evidence our clients hand to their auditors.

What you’ll do

• Map FedRAMP High, SOC 2 and NIST 800-53 controls to concrete platform configuration and automated checks
• Build "governance-as-code" pipelines that generate System Security Plan artifacts from live configuration
• Run continuous control monitoring and drive remediation of configuration drift with engineering teams
• Prepare evidence packs for client audits and support assessors during authorization cycles
• Advise product teams on control inheritance for newly acquired applications moving into our boundary

What you’ll bring

• 5+ years in GRC engineering, security compliance or cloud security
• Hands-on experience delivering a FedRAMP (Moderate or High) or SOC 2 Type II program
• Working knowledge of AWS or Azure security services and infrastructure-as-code
• Ability to explain control intent to engineers and evidence quality to auditors
• US citizenship required for access to FedRAMP boundaries

Nice to have

• CISSP, CISA or CCSP
• Experience with GRC platforms and OSCAL

Location and working arrangement

This role is hybrid, based in our New York office. You’ll need to be able to work from New York on a regular basis, and your team agrees its own rhythm for being together.

The application asks whether you are authorized to work in the United States or will need visa sponsorship. Sponsorship depends on the role and the country; your recruiter will be clear about what is possible before you invest time in interviews.

Compensation

$220,000 – $250,000 per year

Where you land in the range depends on your experience and skills, not on how well you negotiate. Any offer we make is within this range.

How to apply

1. ApplyAbout five minutes. You get a private link to track your application.
2. Recruiter reviewA recruiter reads every application, usually within five business days.
3. Recruiter screenA 30-minute call about your experience and what you are looking for.
4. InterviewsUsually two to three conversations with the team, including a practical exercise relevant to the role.
5. OfferPay is always within the range on the listing. We check references before you start.

You’ll need your résumé (PDF, Word (.doc or .docx), RTF or plain text, up to 5 MB) or a link to your LinkedIn profile or online résumé. Applying takes about five minutes, and you can create a candidate account to save your progress and follow every application in one place. How we hire explains each step.

Apply now

Working at Moraph

We build and operate software for credit unions, hospitals and government agencies, where a failure means a regulatory breach or a patient-safety incident. We work as one team across New York, London, Sydney, Buenos Aires, Yerevan, Mumbai, Manila and more, on the same tools and to the same standards. Everyone gets the same high-spec laptop, software and security tooling, whichever office they work from.

Equal opportunity and accommodations

Moraph is an equal opportunity employer. We welcome applicants of every background and provide reasonable accommodations throughout the hiring process. Tell us in your application, or email careers@moraph.com. How to ask for an accommodation.