Governance, Risk & Compliance (GRC) Analyst
Core
Build and run the security compliance program enabling AI platforms to operate inside the Department of Defense, driving RMF packages and maintaining NIST SP 800-171, CMMC, and FedRAMP posture.
Role type
Senior GRC Analyst (DoD/FedRAMP)
Builds
Authorized AI systems for national security missions
Domain
Defense / Cybersecurity Compliance
Deliverable
production ML models
Required skills
DoD RMF process, NIST SP 800-171, CMMC Level 2, NIST SP 800-53, FedRAMP, Risk Management Framework, System Security Plan (SSP), Plans of Action & Milestones (POA&Ms), Cloud architecture assessment, Government stakeholder management, eMASS, GRC platforms
Preferred skills
CISSP, CISM, CAP/CGRC, Security+, CMMC Certified Professional/Assessor, Policy-as-code, Compliance automation tooling, AI/ML product authorization experience, Startup environment experience, Military or government background
Technologies
AWS GovCloud, Azure Government, eMASS, GRC platforms, CI/CD pipelines
Responsibilities
Drive RMF authorization packages from categorization through ATO; Maintain SSP, POA&Ms, and control implementation statements; Coordinate data sharing agreements and interconnection documentation; Build and maintain compliance posture against NIST SP 800-171, CMMC, and NIST SP 800-53; Run continuous monitoring including control testing and evidence collection; Lead FedRAMP readiness and authorization efforts; Maintain risk register and evaluate third-party/supply chain risk; Partner with Engineering to embed security controls into infrastructure-as-code and CI/CD workflows; Brief leadership on risk posture and remediation priorities.
Seniority
Senior, hands-on IC
