Automate security evidence generation and map RMF controls to support continuous authorization.
Conduct security audits and risk analyses, and plan and implement remediations.
Coach government teams to sustain security practices after the engagement ends.
Skylight is a digital consultancy that uses design and technology to help government agencies deliver better public services. They are a growing team of public interest technologists committed to civic innovation.
Provide SA/OSA expertise and guidance for the security authorization program.
Review ATO packages, PIAs, SSPs, and artifacts for RMF compliance and continuous monitoring.
Track authorization renewals and support audits and data collection for FISMA reporting.
SkyePoint Decisions is an IT service provider specializing in cybersecurity, critical infrastructure, and applications development for federal clients. It is an ISO-certified small business with a collaborative culture built on accountability and individual performance.
Maintain RMF authorization packages, security-control implementation statements, and continuous-monitoring evidence.
Support ATO/ATC package reviews, security-control testing, and Security Test and Evaluation planning.
Coordinate with ISSMs, system owners, and assessors to resolve comments and maintain traceable authorization documentation.
DecisionPoint Corporation is a professional services firm supporting federal and Department of Defense programs. It offers careers in cybersecurity, IT, and management consulting with an emphasis on mission-driven work and equal employment opportunity.
Supports Security Authorization and Ongoing Security Authorization activities under NIST RMF.
Reviews security documentation and artifacts for ATO packages, including SSPs, PIAs, and POA&Ms.
Tracks authorization renewals and supports continuous monitoring, audits, and compliance data calls.
SkyePoint Decisions is a cybersecurity architecture, engineering, and IT services provider supporting federal government clients. As an ISO-certified small business, it fosters a collaborative culture focused on individual performance, accountability, and gratitude.
Improve automated security assurance workflows to reduce manual effort and increase consistency.
Streamline collection and analysis of security evidence to improve audit readiness and visibility.
Enhance efficiency of access reviews, control testing, and risk assessments through technical automation.
Chainlink is the industry-standard oracle platform bringing capital markets onchain and powering decentralized finance. It has enabled tens of trillions in transaction value and is adopted by major financial institutions and protocols, with a remote-first culture.
Develop and maintain automated security compliance, testing, and continuous monitoring capabilities.
Automate DISA STIG and SCAP benchmark scanning using ACAS, Tenable SecurityCenter, and Nessus.
Integrate security gates into CI/CD pipelines with GitLab, SonarQube, Fortify, and AWS services.
CSCI Consulting is an award-winning information technology and financial management consulting firm focused on delivering world-class services. The company values each associate's drive to excel and fosters an energizing, diverse culture where work and fun coexist.
Develop and maintain the information security internal audit program, aligning with FedRAMP and CMMC.
Own monthly continuous monitoring assessments and serve as a technical point of contact during audits.
Build automated evidence collection and policy-as-code checks across cloud and CI/CD systems.
Everbridge helps enterprises and government organizations prepare for, respond to and recover from critical events. This role is fully remote, and the company emphasizes collaboration, compliance, and technical excellence across its teams.
Analyze current processes and user needs to identify workflow automation opportunities.
Design and develop workflow applications, services, scripts, and integrations using customer-approved technologies.
Integrate workflows with APIs, data sources, and security tools, and support automated testing and documentation.
SkyePoint Decisions is a cybersecurity architecture and IT service provider delivering enterprise solutions to federal government clients. The company is a small, collaborative business certified at CMMI Level 3 that values accountability, professional development, and work-life balance.
Own the end-to-end continuous control monitoring program across cloud, identity, code, and endpoint systems.
Build centralized common controls frameworks and automated evidence management using Python, APIs, and policy-as-code.
Provide technical leadership during audits and collaborate with security teams to modernize GRC through automation and AI-assisted workflows.
The company is a technology organization focused on secure and compliant cloud operations. It is a globally distributed, remote-first team that emphasizes collaboration, ownership, and professional growth.
Work on real-world security and compliance challenges with the Security and Compliance Team.
Support GRC tools like Drata, security tools like Crowdstrike, and AI-powered vulnerability dashboards.
Contribute to audit evidence collection, vulnerability analysis, and AWS cloud security operations.
OpenSesame is transforming workforce development with an AI-powered marketplace of skill-building courses and learning pathways. More than 2,000 companies, including 150+ of the Global 2000, rely on OpenSesame to develop the world's most productive and admired workforces.
Implement security strategies tailored to cloud environments like AWS, GCP, and Azure.
Conduct cloud security assessments to identify vulnerabilities and risks in cloud infrastructure.
Prepare security compliance reports and execute Security Controls Test plans for ATO requests.
SkyePoint Decisions is a cybersecurity architecture and engineering, IT services provider supporting federal government clients. It is an ISO-certified small business with a collaborative culture that values flexibility and professional development.
Drive end-to-end audit cycles for SOC 2 Type II and ISO 27001/27701/42001, including evidence collection, control testing, auditor liaison, and remediation tracking.
Support FedRAMP program efforts, vendor risk assessments, and customer security assurance.
Automate compliance processes using Tines and operate continuous control monitoring.
Tines is the intelligent workflow company that powers important workflows by integrating with any API-enabled service for IT and security teams. The company values Simplicity, Speed, and Soundness, fostering a culture of curiosity, growth, and integrity.
Develop and maintain GitLab CI/CD pipelines, including reusable jobs, parent/child pipelines, and integrated security testing.
Build and maintain AWS GovCloud infrastructure using Terraform and Ansible, focusing on secure, resilient, and maintainable solutions.
Automate security controls, troubleshoot complex infrastructure issues, and provide technical guidance across teams.
LMI is a digital solutions provider dedicated to accelerating government impact with innovation and speed, serving federal agencies across defense, space, healthcare, and energy. Headquartered in Tysons, Virginia, LMI focuses on agility and collaboration to deliver impactful results and drive lasting value.
Conduct comprehensive assessments of security controls and enhancements to ensure they meet NIST and federal requirements.
Develop and execute Security Controls Test (SCT) plans, including vulnerability scans and penetration testing aligned with DHS RVA standards.
Prepare security assessment reports, POA&M inputs, and risk ratings to support authorization decisions.
SkyePoint Decisions is a cybersecurity architecture, engineering, and IT services provider supporting federal government clients. The company is an ISO-certified, CMMI Level 3 small business that fosters a collaborative culture built on individual performance and accountability.
Own software projects from discovery through launch, defining problems, success measures, and technical trade-offs.
Lead automation of evidence collection for SOX and other compliance requirements across key systems.
Build and maintain integrations and scheduled workflows across cloud, identity, HR, finance, ticketing, and GRC systems.
Reddit is a community of communities built on shared interests, passion, and trust, hosting the most open and authentic conversations on the internet. With 100,000+ active communities and approximately 130 million daily active unique visitors, Reddit is one of the internet's largest sources of information, fostering a culture of collaboration and impact.
Lead and mature Affirm's Security Third Party Program, designing and implementing scalable processes and controls.
Own pre-launch security due diligence for third parties supporting international expansion and M&A.
Drive automation with Python and agentic coding tools to replace manual GRC work with code-defined workflows.
Affirm provides clear, predictable buy now, pay later financial products with no hidden fees. It is a remote-first company that values security, transparency, and care, offering flexible benefits and an inclusive culture.
Design and deliver automation workflows that help security analysts detect, investigate, and remediate threats faster.
Architect deterministic and agentic automation pipelines integrating services, scripting, orchestration, and security data enrichment.
Provide technical leadership, mentor engineers, and improve service reliability through monitoring, observability, and on-call support.
They build and operate Falcon Complete, a managed detection and response platform that protects organizations from cyber threats. They are a globally distributed, remote-first team focused on collaboration, innovation, and engineering excellence.
Lead end-to-end compliance efforts for U.S. Federal customers, including readiness assessments, audits, and continuous monitoring.
Serve as the compliance lead for federal authorization efforts, including Agency ATOs, FedRAMP initiatives, and security assessments.
Drive adoption of continuous compliance automation and cross-functional program leadership across engineering, cloud, and security teams.
Entrust is an industry leader in identity-centric security solutions, serving over 150 countries with cutting-edge, scalable technologies. The company values curiosity, dedication, and innovation, fostering a culture built on diversity, inclusion, and respect.
Partner with product teams to ensure security is embedded throughout the product development lifecycle.
Conduct threat modeling, architecture reviews, and source code analysis to identify and mitigate vulnerabilities.
Automate security processes and drive cross-team projects to closure.
Affirm exists to give people a clear, predictable way to pay over time with no hidden fees, building honest financial products. It is a remote-first company that values information security, transparency, and flexibility, with a strong culture of care.
Act as the engineering voice of security and compliance, turning regulatory standards into practical controls you ship to production.
Own certifications, audits and attestations like ISO 27001, SWIFT and SOC 2, driving findings to closure.
Improve release, change, post-incident and operational resilience processes with automation and clear documentation.
Griffin is a fully regulated UK bank providing banking infrastructure and payments for fintechs and platforms. They are a remote-first, high-trust company with a small, cross-functional engineering culture and a mission-driven approach.