Governance, Risk & Compliance Analyst II

This is a fully remote position, open to applicants in United States.

📋 Description

• Review, update, and uphold Comtech cybersecurity policies, standards, and procedures.

• Ensure that documentation complies with DFARS, CMMC, NIST SP 800-171, NIST CSF, and internal compliance goals.

• Assist in crafting policies and procedures that address regulatory discrepancies and audit findings.

• Gather and maintain evidence for NIST SP 800-171 controls across all families.

• Conduct internal control testing and verify control operation through screenshots, configurations, and interviews.

• Aid in external CMMC assessments and DIBCAC audit readiness initiatives.

• Document compliance deficiencies and monitor remediation plans with stakeholders.

• Support enterprise risk assessments and risk tracking activities.

• Document risks, assess severity, and formulate mitigation recommendations.

• Perform reviews of privileged access, separation-of-duties, and user lifecycle management.

• Document CUI data flows, system boundaries, network diagrams, and locations for CUI storage/transmission.

• Validate CUI access controls, session lock/termination parameters, and security notifications.

• Conduct role-based access reviews, privileged account audits, and separation-of-duties evaluations.

• Collaborate with system owners to compile lists of authorized users, devices, and system accounts.

• Check failed login thresholds, session timeouts, security banners, and role permissions.

• Prepare audit packages and evidence submissions in partnership with internal audit teams and external partners.

• Maintain repositories of assessment artifacts, reports, and compliance documentation.

• Support quarterly and annual control reviews.

• Maintain and refresh incident response, disaster recovery, and business continuity documentation.

• Collect evidence and assist in after-action reviews.

• Resolve compliance-related tickets involving documentation, evidence updates, or access verification.

• Ensure timely responses and remediation for overdue compliance tasks.

⛳️ Requirements

• Previous experience supporting compliance in a DoD contractor environment.

• Prior experience with NIST SP 800-171 requirements.

• Familiarity with CUI identification and marking standards.

• Experience with basic system administration, including Active Directory role and permissions assessments.

• Strong knowledge of NIST SP 800-171 (R2/R3), DFARS, CMMC Level 2, and federal cybersecurity compliance.

• Experience in conducting access reviews, collecting control evidence, and preparing for audits.

• Ability to read and interpret technical configurations, logs, and administrative settings.

• Excellent writing skills for policy reviews, control documentation, and evidence narratives.

• Strong analytical skills with a focus on detail and accuracy.

• Ability to collaborate across functions with IT, security, engineering, and external assessors.

• Proficient in Microsoft 365, SharePoint, and management of compliance documentation.

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Business IT, or a related field.

• 2–5 years of experience in GRC, IT audit, cybersecurity compliance, or risk management.

• Security+, CGRC, CAP, CMMC-RP, CCP, CISA, or similar governance/compliance certifications.

• Successful completion of a pre-employment drug screening.

• Compliance with Comtech’s Drug-Free Workplace Program.

• Illegal drug use, including marijuana regardless of state law, is disqualifying under federal adjudicative guidelines and DoD DFARS requirements.

🏝️ Benefits

• Base salary range of $73,200–$91,200 annually.

• Comtech’s Drug-Free Workplace Program.

• Equal Opportunity Employer.