Compliance & Security Analyst

Role overview

Essential duties

• Author System Security Plans detailing implementation of each NIST 800-171 control.
• Develop and manage Plans of Action and Milestones, track deficiencies, and guide remediation.
• Draft functional security policies that reflect client operations.
• Design and facilitate annual incident response and disaster recovery tabletop drills.
• Lead evidence collection and verify logs and configurations meet C3PAO auditor sufficiency standards.
• Maintain knowledge of applicable laws, regulations, and company policies; provide customer service consistent with expectations.

Education and technical requirements

• A bachelor's degree in a related field is required; an equivalent combination is accepted.
• Mastery of CMMC 2.0 Level 2 and NIST SP 800-171 is required.
• Required technical knowledge includes CUI enclave segmentation, FIPS 140-2/3 validation, network architecture, boundary protection, data flows, and audit-ready logs.
• Superior technical writing is required for clear, audit-proof SSPs, SOPs, and policies.

Other qualifications

• Ability to work with C-suite executives and client technical teams throughout consulting engagements.
• Ability to manage approximately 10 concurrent projects, handle ambiguity and competing requests, and communicate business and technical information clearly.
• Knowledge of SOC 2, ISO 27001, HIPAA, or GDPR is listed.
• CCP, CISA, and Security+ certifications are listed.

Tools and platforms

• Experience with GRC platforms such as Apptega, FutureFeed, or Microsoft Purview is listed.

Workplace

• The job is listed as US virtual/remote.