GRC Analyst

The ideal candidate will collaborate closely with technical teams to operationalize compliance requirements, maintain detailed records of compliance activities, and provide ongoing support for audits and regulatory reporting. As a critical member of our team, this individual will collaborate with cross-functional teams to assess risk, implement controls, and maintain compliance while driving continuous improvement of our security posture.

This role is for someone who thrives in a tactical and collaborative environment, is committed to advancing IT compliance initiatives, and is eager to contribute to organizational resilience in an ever-evolving cybersecurity landscape.

Key Responsibilities

• CMMC & NIST Compliance Management
  • Execute day-to-day tasks required for CMMC certification and sustainment, including control mapping, evidence collection, and documentation updates.
  • Coordinate and implement specific cybersecurity controls aligned with CMMC and NIST 800-171 requirements.
  • Track and report progress on compliance action plans and ensure deadlines are met.
  • Lead and manage the organization's efforts to achieve and maintain compliance.
  • Conduct gap analyses and develop a roadmap to address compliance requirements.
  • Liaise with third-party assessors for CMMC certification audits.
• Risk Assessments and Control Monitoring
  • Conduct risk assessments and oversee remediation efforts based on NIST controls.
  • Regularly update policies and procedures to reflect changes in cybersecurity standards.
  • Evaluate the effectiveness of existing controls, document findings, and recommend detailed remediation actions.
  • Maintain risk registers and monitor mitigation plans to ensure completion.
• Audit Preparation and Support
  • Prepare and organize required artifacts for internal and external audits.
  • Conduct mock audits to identify gaps in compliance readiness.
  • Act as the point person during audit activities to facilitate document reviews and follow-up actions.
• Risk and Compliance Management
  • Develop, implement, and manage enterprise-level GRC strategies and frameworks.
  • Perform risk assessments, audits, and security control testing to identify gaps and recommend solutions.
  • Monitor regulatory changes and ensure the organization's practices remain compliant.
• Documentation and Training
  • Create and maintain documentation of security policies, procedures, and control implementations.
  • Conduct training and awareness programs for internal stakeholders regarding compliance requirements and practices.
• Collaboration and Communication
  • Act as the primary point of contact for compliance-related inquiries.
  • Collaborate with IT, legal, and other departments to align GRC practices with business objectives.

Education, Experience, and Skills

• Bachelor's degree in cybersecurity, information technology, business administration, or a related field (or equivalent experience).
• 3+ years of experience in IT governance, risk management, and compliance.
• Familiarity with relevant standards and frameworks, such as NIST 800-171, CMMC, ISO 27001, COBIT, DFARS.
• Strong analytical and problem-solving skills, with attention to detail.
• Excellent communication and project management skills.
• Relevant certifications preferred, such as:
  • Certified Information Systems Security Professional (CISSP)
  • Certified Information Systems Auditor (CISA)
  • Certified Information Security Manager (CISM)
  • Certified CMMC Professional (CCP) or CMMC Assessor