We are seeking a Senior Governance, Risk & Compliance (GRC) Analyst to support and mature the organization's governance, risk management, compliance, and business continuity programs.
Reporting to the Director of IT Risk Management, this role focuses on CMMC Level 1 and Level 2 compliance, enterprise risk management, audit readiness, third-party risk, and administration of the Onspring GRC platform.
The successful candidate will work collaboratively across business and technology teams and with external partners, auditors, assessors, and service providers to drive compliance, accountability, and continuous improvement.
The ideal candidate brings strong CMMC and NIST SP 800-171 expertise, exceptional written and verbal communication skills, and the ability to translate complex regulatory requirements into practical business processes and technical controls.
Job ResponsibilitiesCMMC Compliance & Regulatory Governance
- Support and enhance the organization's CMMC Level 1 and Level 2 compliance program in alignment with NIST SP 800-171 requirements.
- Maintain compliance documentation, including System Security Plans (SSPs), policies, procedures, Plans of Action and Milestones (POA&Ms), and supporting assessment artifacts.
- Coordinate with our Enclave hosting provider to ensure shared responsibility controls are clearly defined, documented, and monitored.
- Partner with control owners, business stakeholders, technology teams, and external assessors to evaluate compliance and track remediation activities.
- Support CMMC assessments, audits, and readiness activities through evidence collection, documentation management, and control validation.
- Monitor regulatory, contractual, and customer compliance requirements and help translate them into actionable business and technical processes.
- Communicate compliance obligations, risks, and program status clearly to both technical and non-technical audiences.
Enterprise Governance, Risk Management & Audit Readiness
- Support the development and maturation of enterprise governance, risk management, and compliance processes.
- Conduct risk assessments, maintain risk registers, and track remediation activities to improve risk visibility, accountability, and decision-making.
- Coordinate internal audits, external audits, customer assessments, and regulatory reviews, maintaining appropriate evidence and documentation to support audit readiness.
- Partner with stakeholders across the organization to identify risks, address compliance gaps, and strengthen governance practices.
- Support the development, maintenance, and continuous improvement of the organization's Business Continuity and Operational Resilience program.
- Conduct Business Impact Analyses (BIAs) and partner with business stakeholders to identify critical processes, dependencies, recovery requirements, and operational risks.
- Develop, maintain, and test Business Continuity and Disaster Recovery plans, incorporating lessons learned and remediation activities from exercises and testing.
- Manage Business Continuity documentation, workflows, reporting, and program administration within the Onspring GRC platform.
Third-Party Risk Management
- Support the third-party risk management lifecycle, including vendor onboarding, due diligence reviews, periodic assessments, and ongoing monitoring.
- Assess supplier security, compliance, operational, and business continuity risks.
- Coordinate with Procurement, Legal, Information Technology, and business stakeholders to ensure vendor risk requirements are addressed appropriately.
- Track assessment findings, remediation activities, and risk acceptance decisions.
- Maintain visibility into third-party risk exposure through effective reporting and dashboarding.
Security Risk Analysis
- Review vulnerability assessment results, security findings, and remediation recommendations provided by internal teams and service providers.
- Assess technical findings to determine business impact, likelihood, and overall organizational risk.
- Work collaboratively with technical teams to prioritize remediation efforts using a risk-based approach.
- Translate technical security issues into clear business risk statements and recommendations for leadership.
- Assist with evaluating the effectiveness of security controls and identifying opportunities for improvement.
Qualifications/Requirements
Required- Bachelor's degree in Information Systems, Cybersecurity, Information Technology, Business, Risk Management, or a related field, or equivalent professional experience.
- 5+ years of experience in governance, risk management, cybersecurity, compliance, audit, or related disciplines.
- Demonstrated experience supporting CMMC and NIST SP 800-171 compliance programs.
- Experience developing and maintaining SSPs, POA&Ms, policies, procedures, risk assessments, and audit evidence repositories.
- Experience administering or supporting a GRC platform, preferably Onspring.
- Strong understanding of risk management, governance principles, and compliance frameworks.
- Working knowledge of security controls, vulnerability management, access management, and networking fundamentals.
- Exceptional written and verbal communication skills.
- Strong organizational, analytical, and problem-solving abilities.
- Ability to manage multiple priorities independently while collaborating effectively across teams.
Preferred- Certifications such as Certified CMMC Professional (CCP), CISSP, CISA, CRISC, CGRC, CBCP, or Security+
- Experience supporting NIST 800-53, NERC CIP, SOC 2, ISO 27001, or similar frameworks.
- Experience developing or enhancing a Business Continuity Management Program.
- Experience in regulated environments (DoD, defense, critical infrastructure).
- Experience creating dashboards, workflows, and automation within GRC platforms.
- Familiarity with Microsoft 365, Microsoft Azure, and cloud security concepts.
- Experience supporting AI governance or emerging technology risk initiatives.
Compensation is determined based on factors such as experience, knowledge, qualifications, and performance. The compensation range for this position is $90,000.00 - $110,000.00 and is exclusive of any other benefit and/or bonus. Hiring at the maximum of the range would not be typical to allow for future and continued growth.
Professionals
