Cybersecurity GRC Senior Analyst

SAIC; Oregon; Hybrid; USD 120,000 - 170,000; Full time

Job summary

SAIC is seeking a qualified Cybersecurity Risk Analyst to join our risk management program in Oregon. You will conduct risk assessments, monitor controls, and coordinate with stakeholders to remediate findings in line with NIST, ISO, and SOC frameworks.

Responsibilities include vendor risk, third‑party assessments, continuous monitoring, audits, and governance. You will help maintain evidence and tooling (ServiceNow GRC) and elevate material risks to leadership.

Qualifications

• Bachelor's or Master’s degree with 3–5+ years of info security experience.
• Certifications such as CISA, CISSP, CISM, or Security+.
• Strong understanding of NIST RMF, SP 800‑53/171, ISO/IEC 27001, COBIT.
• Ability to translate risk into business terms and present to leadership.

Responsibilities

• Maintain awareness of cybersecurity trends to inform risk mitigation.
• Assist risk assessments and document remediation closedown.
• Conduct third‑party risk assessments with procurement and legal.
• Perform supply chain risk assessments and maintain dashboards.
• Support operational cyber activities and security control implementations.
• Drive continuous monitoring per NIST SP 800‑39; track KRIs.
• Manage vulnerability findings and coordinate remediation with owners.
• Prepare audit evidence and participate in ISO 27001, SOC audits.
• Recommend updates to policies and procedures; develop guidance.
• Develop and deliver stakeholder training to strengthen risk culture.

Skills

Analytical skills

Communication skills

Strategic thinking

Project management

Education

Bachelor's degree in Information Technology or similar

Master's degree

Experience in lieu of degree

Tools

ServiceNow GRC

GRC tooling

Vulnerability scanning tools

DLP / Endpoint protection tools

Job description

Responsibilities

• Maintain current awareness of cybersecurity trends and threats to inform risk mitigation strategies.
• Assist with application and system/infrastructure risk assessments and reassessments; document results and track remediation to closure.
• Conduct third‑party (vendor) risk assessments; collaborate with procurement, legal, and business owners on risk treatment.
• Conduct supply chain risk management risk and compliance assessments.
• Assist with operational cyber activities including, but not limited to carbon black application whitelisting reviews, processing international travel requests and managing violations, software assessments/evaluations.
• Select, implement, and assess security controls per NIST SP 800‑171; validate effectiveness.
• Drive continuous monitoring using NIST SP 800‑39; maintain dashboards and key risk indicators.
• Manage vulnerability and penetration test findings; coordinate with system owners to remediate within SLAs.
• Author and maintain risk management program documentation; prepare audit evidence and participate in internal/external audits (ISO/IEC 27001, SOC reports, and related standards).
• Recommend updates to cybersecurity policies, standards, and procedures based on control gaps and remediation outcomes.
• Develop and deliver training and guidance to stakeholders to strengthen a risk‑aware culture.
• Assist with configuration and maintenance of GRC tooling (e.g., ServiceNow GRC or equivalent) to support workflow, evidence management, and reporting.
• Collaborate across security, IT, and business teams; elevate material risks to senior leadership with clear risk statements and options.

Qualifications

Required Skills

• Bachelor's degree in Information Technology or similar discipline and 5 years of experience, or Master's Degree and 3 years of experience. An additional 4+ years of experience may be considered in lieu of a degree.
• Certifications such as CISA, CISSP, CISM, or Security+.
• Comprehensive understanding and applied experience with cybersecurity frameworks and regulations (NIST RMF, NIST SP 800‑53/171, ISO/IEC 27001, COBIT, COSO, MITRE, ITIL, HITRUST, SOC reporting).
• Ability to categorize systems and information per FIPS 199 and NIST SP 800‑60.
• Strong analytical skills; able to synthesize complex information and defend independent judgments.
• Excellent written and verbal communication; able to translate technical risk into business‑focused language and narratives.
• Strategic and self‑directed work style with effective collaboration and negotiation across diverse stakeholders.
• Demonstrated ability to manage multiple projects, prioritize based on urgency and impact, and meet deadlines.

Desired Skills

• Working knowledge of ServiceNow and/or other GRC tools.
• Working knowledge of security tools for vulnerability scanning, DLP, endpoint protection, etc.
• Technical proficiency in Cybersecurity.

SAIC® is a premier mission integrator focused on advancing the power of technology and innovation to serve and protect our world. Our robust portfolio of offerings across the defense, space, intelligence, and civilian markets includes secure high‑end solutions in mission IT, enterprise IT, engineering services, and professional services. We integrate emerging technology, rapidly and securely, into mission critical operations that modernize and enable critical national imperatives.

We are approximately 23,000 strong; driven by mission, united by purpose, and inspired by opportunities. SAIC is an Equal Opportunity Employer. Headquartered in Reston, Virginia, SAIC has annual revenues of approximately $7.3 billion. For more information, visit saic.com. For ongoing news, please visit our newsroom.