GRC Analyst - Public Sector

Required

• 4+ years of hands-on cybersecurity, compliance, or identity-management experience, including demonstrated personal execution of FedRAMP, GovRAMP, or comparable continuous-monitoring work — running scans, building or maintaining a POA&M, and preparing deviation requests. Public sector experience is a plus but not required.
• Direct experience with FedRAMP, GovRAMP, and NIST frameworks (800-53, 800-63, 800-171).
• Proven ability to personally execute continuous monitoring, vulnerability remediation, and compliance reporting.
• Proven ability to design and improve repeatable compliance processes - identifying inefficiencies, defining clear steps, and building structure where none exists; experience using AI tools (e.g., ChatGPT, Glean, Gemini) and machine-readable formats (e.g., OSCAL) to accelerate that work is a strong plus.
• Strong communication, organization, and collaboration skills with the ability to manage multiple priorities, including strong written communication and the ability to write persuasively for a customer audience — distinct from writing that is merely compliance-accurate.
• Ability to adapt to changing requirements
• Demonstrated customer-facing experience and enough exposure to product or sales positioning to distinguish compliance-accurate writing from writing that persuades a buyer; prior RFP-specific experience is not required.
• Must be a U.S. Person (U.S. Citizens or U.S. Permanent Residents) residing in the United States and be able to obtain a U.S. OPM NACI clearance.