GRC Analyst

NextgenID; Fairfax, Northern (VA, KY); Hybrid; USD 75,000 - 95,000; Full time

Job summary

NextgenID is hiring a GRC Analyst to manage compliance documentation, evidence, and audit support for FedRAMP, Kantara, and UK identity programs. The role is onsite at Fairfax, VA, with a strong focus on evidence, questionnaire responses, and remediation tracking.

You will own control documentation, run the operational side of certifications, and coordinate with DevSecOps and vendors to keep POA&M and vulnerability logs current. The position reports to the GRC Lead and requires U.S. citizenship.

Qualifications

• Two or more years in GRC, security compliance, audit support, or a closely related role.
• Working knowledge of NIST SP 800-53 and/or NIST SP 800-63, ISO 27001, or SOC 2.
• Experience gathering evidence and maintaining compliance documentation.
• Experience with vulnerability or POA&M tracking and remediation coordination.
• Familiarity with vulnerability tooling (Qualys or Nessus) and evidence / GRC platforms (Vanta or similar).
• Strong writing and documentation skills for policies, procedures, and questionnaire responses.
• Highly organized and detail‑oriented, able to manage many concurrent items.
• Discreet and reliable with sensitive security and compliance information.
• Must be able to work onsite in Fairfax, VA; U.S. citizen (FedRAMP / federal customer).

Responsibilities

• Compliance Documentation & Evidence — keep the record current and audit‑ready.
• Maintain control documentation, policies, and procedures, and migrate evidence into Vanta.
• Gather and organize evidence from engineering, DevSecOps, and operations leads.
• Convert implemented controls into machine‑readable (OSCAL / JSON) format for FedRAMP submission.
• Authorization & Assessment Support — run the operational side of our certifications.
• Refine and maintain the UK DVS / DIATF documentation package and scoping forms.
• Prepare Kantara assessment materials (SoCA, S3A, KAR) and the Rev 4 gap working draft.
• Coordinate assessment and pentest logistics, scheduling, and evidence with assessors and leads.
• Vulnerability & POA&M Tracking — keep the remediation record honest.
• Produce the monthly POA&M from Qualys findings using the FedRAMP template.
• Track vulnerability remediation and compensating controls with the RedTeam / DevSecOps leads.
• Maintain vulnerability and vendor‑risk evidence logs (for example, the BeyondTrust remediation log).
• Customer & Vendor Assurance Support — answer the questionnaires and support vendor risk.
• Complete security questionnaires (for example, CCRA and customer InfoSec assessments) consistent with prior responses.
• Support third‑party and vendor risk assessments and evidence requests.
• Route completed responses to the GRC Lead and management for review before submission.
• Research & Program Support — support the wider compliance effort.
• Provide compliance and privacy research to the document and product teams.
• Support ADA / Section 508 assessments and international import certification documentation (BIS, WPC, ATA Carnet).
• Help configure and maintain GRC tooling (Vanta) and keep the compliance calendar updated.

Skills

GRC experience

Security compliance

Audit support

Evidence gathering

POA&M tracking

Vulnerability tooling

Vanta experience

Documentation writing

Discretion with sensitive info

Tools

Qualys

Nessus

Vanta

OSCAL/JSON

Job description

Location: Onsite - Fairfax, VA · U.S. Citizen Required (FedRAMP / Federal Customer)

Type: Full Time

NextgenID is hiring a GRC Analyst to do the hands‑on work that keeps our compliance program running. We verify and credential identity at the highest assurance level (IAL3) for federal agencies and enterprises, so evidence, documentation, and audit support are constant, real work. You maintain our control documentation and evidence, run the operational side of our FedRAMP, Kantara, and UK digital‑identity efforts, keep the POA&M and vulnerability tracking current, and complete the security questionnaires our customers send. You report to the GRC Lead. Salary Range: $75,000-$95,000

Role Fit & Non‑Negotiables

• Onsite at our Fairfax, VA headquarters. This role is hands‑on and evidence‑heavy.
• U.S. citizen, required for FedRAMP and federal‑customer obligations.
• Two or more years in GRC, security compliance, audit support, or a closely related role.
• Comfortable owning documentation, evidence, and trackers to a deadline.
• Detail‑oriented and discreet with sensitive security information.

What You Will Own (90 to 180 Day Outcomes)

• Current, well‑organized control documentation and evidence repositories, moving from SharePoint into Vanta.
• The operational FedRAMP evidence effort: control documentation, gap‑finding tracking, and Trust Center content drafts.
• A monthly POA&M produced from Qualys findings using the FedRAMP template, with remediation tracked to closure.
• Completed, consistent security questionnaires delivered on time for GRC Lead review.
• The UK DVS documentation package and Kantara assessment materials kept current and submission‑ready.

Core Responsibilities

Compliance Documentation & Evidence — keep the record current and audit‑ready.

• Maintain control documentation, policies, and procedures, and migrate evidence into Vanta.
• Gather and organize evidence from engineering, DevSecOps, and operations leads.
• Convert implemented controls into machine‑readable (OSCAL / JSON) format for FedRAMP submission.

Authorization & Assessment Support — run the operational side of our certifications.

• Refine and maintain the UK DVS / DIATF documentation package and scoping forms.
• Prepare Kantara assessment materials (SoCA, S3A, KAR) and the Rev 4 gap working draft.
• Coordinate assessment and pentest logistics, scheduling, and evidence with assessors and leads.

Vulnerability & POA&M Tracking — keep the remediation record honest.

• Produce the monthly POA&M from Qualys findings using the FedRAMP template.
• Track vulnerability remediation and compensating controls with the RedTeam / DevSecOps leads.
• Maintain vulnerability and vendor‑risk evidence logs (for example, the BeyondTrust remediation log).

Customer & Vendor Assurance Support — answer the questionnaires and support vendor risk.

• Complete security questionnaires (for example, CCRA and customer InfoSec assessments) consistent with prior responses.
• Support third‑party and vendor risk assessments and evidence requests.
• Route completed responses to the GRC Lead and management for review before submission.

Research & Program Support — support the wider compliance effort.

• Provide compliance and privacy research to the document and product teams.
• Support ADA / Section 508 assessments and international import certification documentation (BIS, WPC, ATA Carnet).
• Help configure and maintain GRC tooling (Vanta) and keep the compliance calendar updated.

What You Must Have Already Done

• Gathered and organized audit evidence and maintained compliance documentation to a deadline.
• Worked with a control framework (NIST 800-53, 800-63, ISO 27001, or SOC 2) on real evidence or gap work.
• Tracked vulnerabilities or POA&M items and coordinated remediation with technical teams.
• Completed a customer or vendor security questionnaire using documented evidence.
• Kept a tracker, repository, or evidence log accurate across many moving items.

Required Qualifications

• Two or more years in GRC, security compliance, audit support, or a closely related role.
• Working knowledge of NIST SP 800-53 and/or NIST SP 800-63, ISO 27001, or SOC 2.
• Experience gathering evidence and maintaining compliance documentation.
• Experience with vulnerability or POA&M tracking and remediation coordination.
• Familiarity with vulnerability tooling (Qualys or Nessus) and evidence / GRC platforms (Vanta or similar).
• Strong writing and documentation skills for policies, procedures, and questionnaire responses.
• Highly organized and detail‑oriented, able to manage many concurrent items.
• Discreet and reliable with sensitive security and compliance information.
• Must be able to work onsite in Fairfax, VA; U.S. citizen (FedRAMP / federal customer).

Preferred Qualifications

• Security+, GRCP, CySA+, or progress toward CISA.
• Exposure to FedRAMP or FISMA continuous monitoring (ConMon) and 3PAO assessments.
• Experience with Kantara / NIST 800-63 identity assurance or UK DIATF / DVS.
• Familiarity with OSCAL or machine‑readable control formats.
• Experience with security questionnaires (CAIQ, CCRA, customer InfoSec assessments).
• Background in an IDaaS, cloud, or federal‑contractor environment.
• You keep trackers and evidence current without being chased.
• You read a control and know what evidence proves it.
• You write clearly enough that your draft needs little rework before sign‑off.
• You chase the last 10 percent of detail that makes evidence audit‑ready.
• You handle sensitive information with discretion and never submit without review.

What Success Looks Like

• Control documentation and evidence are current, organized, and audit‑ready in Vanta.
• The monthly POA&M is produced on time and remediation is tracked to closure.
• UK DVS and Kantara materials are submission‑ready ahead of each deadline.
• Security questionnaires are completed accurately and on time for GRC Lead review.
• Inherited workstreams from the departing analyst and intern continue without gaps.

Why NextgenID

NextgenID builds the compliance‑grade identity infrastructure that federal agencies and enterprises rely on to verify and credential identity at IAL3. Compliance is the product’s license to operate, and the evidence you produce is what makes it real. As GRC Analyst, you will see your work in every certification we hold and every customer questionnaire we clear, and you will grow into deeper risk and program ownership. For the right person, this is the path to a senior GRC or GRC Lead role.

NextgenID focuses on improving the efficiency and speed of mission‑critical, high assurance identity enrollment and credentialing operations that are essential to hundreds of millions of users worldwide.

Our technologies are engineered to dramatically reduce the time and cost of capturing accurate data when creating a digital identity. Our industry‑neutral solutions revolve around "Supervised Remote‑Identity Proofing" to automatically, securely and "remotely" perform all proofing, enrollment and credentialing processes and workflows for our customers. The industry is taking notice as we are now working with some of the largest agencies in the US Defense, intelligence, Civil, State and Local government markets, as well as other national governments and commercial organizations throughout the world.