Staff GRC Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Collaborate with Engineering, Security, and Infrastructure teams to convert FedRAMP High, DoD IL4/IL5, CMMC, NIST SP 800-53/800-171, SOC 2, ISO, and other security requirements into practical technical controls and implementation standards across AWS and Azure.

• Evaluate technical implementations across infrastructure, networking, containers, databases, IAM, encryption, logging, and vulnerability management.

• Establish evidence requirements, validate control implementations, identify gaps, and ensure remediation actions are taken.

• Assist with FedRAMP authorization and ongoing operations, including Continuous Monitoring (ConMon), Plans of Action and Milestones (POA&M) management, vulnerability reporting, evidence packages, and substantial change management.

• Facilitate external assessments and audits, including Third Party Assessment Organization (3PAO) engagements and audit readiness activities.

• Stay updated on evolving federal requirements, such as FedRAMP 20x, and keep stakeholders informed.

• Identify opportunities to enhance compliance through automation and policy-as-code practices.

• Collaborate closely with Security, Engineering, Product, IT, and Legal teams.

• Independently manage the area of responsibility, refine existing processes, and provide guidance to stakeholders as new security requirements emerge.

⛳️ Requirements

• A minimum of 12 years of experience in security compliance, technical Governance, Risk, and Compliance (GRC), cloud security, IT audit, or similar governance roles.

• Practical experience in translating compliance requirements into technical controls and configuration standards.

• Extensive knowledge of cloud/SaaS security, including IAM, encryption, logging, vulnerability management, and secure Software Development Life Cycle (SDLC).

• Experience in supporting FedRAMP authorization, Continuous Monitoring (ConMon), POA&M management, and external assessments.

• Candidates must be authorized to work for any employer in the U.S.

• PMP, CISSP, CISM, CISA, or CCSP certifications are preferred.

🏝️ Benefits

• Opportunity for professional growth and development.

• Collaborative and innovative work environment.

• Competitive salary and comprehensive benefits package.