TechSur is seeking a Senior Security Specialist with governance, risk, and compliance (GRC) expertise to lead Authority to Operate (ATO) work for a federal customer's new cloud services. You will guide customer cloud environments on AWS, Azure, Google Cloud, and Oracle Cloud through the NIST Risk Management Framework, from control mapping and System Security Plans to third-party assessment and continuous monitoring. You will work with cloud engineers, customer security teams, and Authorizing Officials. You will make sure every landing zone, pipeline, and shared service is built to meet NIST SP 800-53 Rev 5, FedRAMP, and customer security requirements, and that it stays compliant once in production. Key Responsibilities Lead ATO preparation for cloud services under NIST SP 800-37 (RMF), NIST SP 800-53 Rev 5, and FedRAMP Moderate/High processes. Develop and maintain System Security Plans, control implementation statements, Customer Responsibility Matrices, and CSP control-inheritance documentation. Coordinate with a Third-Party Assessment Organization (3PAO): support Security Assessment Plans and Reports (SAP/SAR), gather evidence, facilitate interviews, and respond to findings. Manage Plans of Action and Milestones (POA&Ms): track gaps, owners, and remediation dates in ServiceNow and help engineering teams close findings. Run continuous monitoring with CSP-native and third-party tools (AWS Security Hub, Microsoft Defender for Cloud, GCP Security Command Center, OCI Cloud Guard, Prisma Cloud) and produce monthly compliance reports. Prioritize vulnerabilities using CVSS, exploitability, and customer risk ratings. Review architectures, IaC templates, and CI/CD pipelines for alignment with Zero Trust (NIST SP 800-207), CIS Benchmarks, and customer security standards. Help develop incident response playbooks mapped to MITRE ATT&CK and take part in tabletop exercises. Brief customer security leadership and present security posture at monthly Security & Compliance reviews.