Title: Governance, Risk & Compliance Analyst II
Department: Admin & compliance 802900
Revision Date: 8/6/2026
FLSA Status: Exempt
Location: Remote
Level: P2
Position SummaryThe GRC Analyst II is a midlevel compliance professional responsible for supporting Comtech's enterprise cybersecurity governance, risk management, regulatory compliance, and audit readiness programs. This role plays a critical part in maintaining compliance with Department of Defense (DoD) requirements, including CMMC, DFARS [redacted]/7019/7020, and NIST SP 800-171.
The Analyst II will work closely with IT, Security, Engineering, Manufacturing, and external assessment partners to ensure Comtech systems, processes, and documentation meet federal, contractual, and industry cybersecurity standards.
Responsibilities:Governance & Policy Management
- Review, update, and maintain Comtech cybersecurity policies, standards, and procedures.
- Ensure documentation aligns with DFARS, CMMC, NIST SP 800171, NIST CSF, and internal compliance objectives.
- Assist in drafting new policies and procedures to address regulatory gaps and audit findings.
Compliance Program Execution
- Collect and maintain evidence for NIST SP 800171 controls across all families.
- Perform internal control testing; validate control operation through screenshots, configurations, and interviews with system owners.
- Support readiness activities for external CMMC assessments and DIBCAC audits.
- Document compliance gaps and work with stakeholders to track remediation plans.
Risk Management
- Support enterprise risk assessments and risk tracking activities.
- Document identified risks, evaluate severity, and develop mitigation recommendations.
- Conduct reviews of privileged access, separation of duties, and user lifecycle management.
CUI Identification & Handling
- Assist in documenting CUI data flow, system boundaries, network diagrams, and CUI storage/transmission locations.
- Validate enforcement of CUI access controls, session lock/termination parameters, and security notices.
- Support ongoing reviews of systems handling CUI to maintain administrative and technical compliance.
Access Control & Identity Governance
- Perform and document role based access reviews, privileged account audits, and separation of duties analysis.
- Coordinate with business unit system owners (e.g., M2K, ERP, AD administrators) to compile lists of authorized users, devices, and system accounts.
- Validate configurations related to failed logon thresholds, session timeouts, security banners, and role permissions.
Internal Audit & External Assessment Support
- Work with internal audit teams and external partners (e.g., RISC Point) to prepare audit packages and evidence submissions.
- Maintain organized repositories of assessment artifacts, reports, and compliance documents.
- Support quarterly and annual control reviews.
Incident Response & Business Continuity Support
- Assist in maintaining and updating IR, DR, and BCP documentation.
- Collect evidence and support after action reviews, helping to improve response plans and procedures.
Operational Support & Ticket Management
- Resolve compliance related tickets requiring documentation, evidence updates, or access verification.
- Ensure timely response and remediation for aging compliance tasks.
Skills:- Prior experience supporting compliance within a DoD contractor environment.
- Prior experience supporting NIST 800-171 requirements
- Familiarity with CUI identification and marking requirements.
- Experience with system administration basics (e.g., Active Directory roles/permissions review).
- Certifications: Security+, CGRC, CAP, CMMC-RP, CCP, CISA, or similar governance/compliance credentials.
Requirements:- Strong understanding of NIST SP 800171 (R2/R3), DFARS, CMMC Level 2, and federal cybersecurity compliance.
- Experience performing access reviews, control evidence collection, and audit preparation.
- Ability to read and interpret technical configurations, logs, and administrative settings.
- Excellent writing skills for policy review, control documentation, and evidence narratives.
- Strong analytical capabilities with attention to detail and accuracy.
- Ability to work cross functionally with IT, security, engineering, and external assessors.
- Proficiency with Microsoft 365, SharePoint, and compliance documentation management.
Education and Experience:- Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Business IT, or related field.
- 2-5 years of experience in GRC, IT audit, cybersecurity compliance, or risk management.
The pay range reflects the expected base salary for this position. Final compensation will be based on role, level, skills, experience, and geographic location. 
