Enterprise Cyber Risk & GRC Analyst

CompQsoft Inc; Leesburg (VA); On-site; USD 120,000 - 128,000; Full time

Job summary

CompQsoft Inc. is seeking a senior GRC professional to drive enterprise cybersecurity risk management. You will quantify risks, assess control effectiveness, and align with NIST 800-53 and FISMA, collaborating with Cybersecurity Engineers and Business Analysts to define guardrails and remediation priorities.

You will lead risk assessments, audits, and user awareness programs, and oversee the POAandM lifecycle while reporting key risks to leadership using tools like Power BI and Excel.

Qualifications

• Expertise in GRC methodologies, third-party risk management (TPRM), and federal compliance (NIST SP 800-53, 800-37).
• Risk Register tracking and maintenance, performing Security Impact Analyses, managing the POAandM lifecycle, and developing security awareness content to mitigate human-centric risks.
• Lead enterprise-wide risk assessments to identify, evaluate, and prioritize risks, translating vulnerabilities into business impact for stakeholders.

Responsibilities

• Lead enterprise-wide risk assessments using GRC methodologies and translate technical vulnerabilities into business impact for stakeholders.
• Ensure ongoing compliance with federal frameworks (NIST SP 800-53/800-37 RMF) through audits and security analyses.
• Maintain and manage the enterprise Risk Register and the full lifecycle of POAandM with defined SLAs.
• Design and implement security awareness programs and phishing simulations to reduce social engineering risks.

Skills

GRC methodologies

TPRM

Regulatory compliance

Risk assessment

Risk quantification

Stakeholder communication

Tools

Archer

ServiceNow

OneTrust

Prevalent

KnowBe4

Proofpoint

Power BI

Excel

JIRA

Job description

CompQsoft Inc. is seeking a senior GRC professional to drive enterprise cybersecurity risk management. You will quantify risks, assess control effectiveness, and align with NIST 800-53 and FISMA, collaborating with Cybersecurity Engineers and Business Analysts to define guardrails and remediation priorities.

You will lead risk assessments, audits, and user awareness programs, and oversee the POAandM lifecycle while reporting key risks to leadership using tools like Power BI and Excel.