GRC Analyst

C2 Labs, Inc.; Knoxville (TN); On-site; USD 65,000 - 90,000; Full time

Job summary

C2 Labs, Inc. is seeking a Governance Risk and Compliance (GRC) Analyst to join our security team in Knoxville. You will implement regulatory frameworks (FISMA, FedRAMP, StateRAMP), develop security documentation (SSP, SAP, SAR), and maintain RMF artifacts for FedRAMP cloud environments.

Strong writing and client-facing skills are essential. The role emphasizes creating clear security control statements, coordinating with engineers, and delivering risk assessments and training.

Qualifications

• 1–3 years in IT consulting focusing on RMF.
• US Citizenship and ability to pass a Public Trust background check.
• Strong communication and technical writing skills.
• Familiarity with NIST 800-53, FedRAMP, and StateRAMP.

Responsibilities

• Develop, review, and update security authorization package documentation (SSP, SAP, SAR, POA&M).
• Develop, review, and update Contingency Plan (CP), Incident Response Plan (IRP), and Configuration Management Plan (CMP).
• Conduct Security Impact Assessments (SIAs) on information systems changes.
• Create the Control Implementation Summary and CRM workbook outlining CSP and customer responsibilities.
• Develop and update policies aligning with NIST 800-53 controls.
• Leverage GRC tools to automate SSP creation.
• Review current RMF processes and provide improvement recommendations.
• Develop and deliver Risk Assessment Reports (RAR).
• Provide guidance on FedRAMP and StateRAMP control requirements.
• Deliver training on RMF tasks to stakeholders.

Skills

RMF familiarity

FedRAMP knowledge

GRC documentation

Technical writing

Client communication

Education

Security certifications (CISSP/CISM/CAP)

Tools

GRC tools

NIST templates

Job description

C2 Labs [www.c2labs.com] partners with clients on their IT transformation journey via data-driven IT strategic planning, application rationalization and redevelopment, and innovative research and development of new industry standards and technologies. C2 Labs provides specialized products and services that allow our clients to innovate with speed and scale seamlessly while maintaining a robust and effective security posture. C2 has a unique approach to client success enablement that is empowered by ART (Application Rationalization and Transformation) and SCIENCE (Strategic Client Interview and Engineering to assess, design, and implement Cloud Ecosystems) to couple creative new approaches/technologies with proven methodologies that deliver rapid results.

Must Live in the Knoxville, Tennessee metro area and Must be a US Citizen and capable of passing a Public Trust background investigation. For a two year contract.

Job Summary:

As a Governance Risk and Compliance (GRC) Analyst at C2 Labs you will work with a team of security analysts and engineers to implement regulatory frameworks such as the Federal Information Security Modernization Act (FISMA), the Federal Risk Authorization Management Program (FedRAMP) and the State Risk Authorization Management Program (StateRAMP). You will leverage GRC tools to develop security authorization package documentation such as the System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Report (SAR), and the Plan of Actions & Milestones (POA&M) in human readable and machine-readable formats. You will draft security control implementation statements with enough detail to facilitate the testing of the controls and will develop supporting documentation including the Contingency Plan (CP), Incident Response Plan (IRP), and Configuration Management Plan (CMP). As a GRC Analyst 1 your primary responsibility will be to ensure the timely development of the security authorization package in accordance with C2 Labs quality standards.

Job Responsibilities:

• Develop, review, and update security authorization package documentation to include the System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Governance Risk and Compliance (GRC) Analyst 1 Report (SAR), and Plan of Actions and Milestones (POA&M).
• Develop, review, and update supporting documentation including the Contingency Plan (CP), Incident Response Plan (IRP), and Configuration Management Plan (CMP).
• Conduct Security Impact Assessments (SIAs) on changes to information systems
• Create the Control Implementation Summary (CIS)/Customer Responsibility Matrix (CRM) workbook outline Cloud Service Provider (CSP) and customer responsibilities.
• Develop, review, and update policies and procedures to support the implementation of the NIST 800-53 control families.
• Leverage the next generation of Governance Risk and Compliance (GRC) tools to automate the creation of the SSP.
• Review current security assessment and authorization processes and provide recommendations for improvement.
• Develop Risk Assessment Reports (RAR).
• Provide guidance on NIST 800-53, FedRAMP, and StateRAMP control requirements.
• Develop and deliver training to educate stakeholders on the various tasks and activities associated with the RMF.

Qualifications:

• Minimum 1-3 years’ experience in IT consulting specializing in Governance, Risk, and Compliance using the RMF.
• CISSP, CISM, or CAP certification is preferred but not required.
• Excellent communication and interpersonal skills, with the ability to build a rapport and trust with clients.
• Knowledge of the cybersecurity industry to include regulatory frameworks such as the National Institute of Standards in Technology (NIST) Risk Management Framework (RMF), Federal Risk Authorization Management Program (FedRAMP), Department of Defense (DoD) Impact Levels (2-6), and the State Risk Authorization Management Program (StateRAMP). Governance Risk and Compliance (GRC) Analyst 1
• Possesses an in-depth understanding of the FedRAMP authorization process and associated templates and deliverables.
• Must have experience creating security authorization package documentation (i.e., SSP, SAP. SAR, & POA&M) and managing system authorization artifacts for a FedRAMP authorized cloud environment.

Working knowledge of:

• NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations
• FedRAMP Security Controls Baselines (i.e., Low, Moderate, High, and Li-SaaS)
• StateRAMP Security Control Baselines (i.e., Low Impact Ready, Low Impact Authorized, Moderate Impact Ready, Moderate Impact Authorized)
• NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems
• Must have strong technical writing skills.
• Must be able to work independently under only general direction.
• Must be able to interpret and provide consulting expertise on FedRAMP security requirements.
• Must have extensive knowledge in reviewing, analyzing, and documenting the secure implementation of logical controls, physical controls, environmental controls, personnel security, and incident handling.
• Experience preparing monthly continuous monitoring deliverables (e.g., vulnerability scans, POA&Ms, and asset inventory) for submission to the FedRAMP PMO.
• Must have extensive knowledge in reviewing, analyzing, and documenting the secure implementation of logical controls, physical controls, environmental controls, personnel security, and incident handling.
• Must be a US Citizen and capable of passing a Public Trust background investigation.

EEO Statement

We are an equal opportunity employer. All qualified applicants will be considered without discrimination based on race, color, religion, sex, national origin, age, disability, or protected veteran status. Employment offers will be contingent on passing a pre-employment drug screen.

Practical AI Application

• Applies AI tools to streamline workflows, enhance decision-making, and improve outcomes
• Understands the strengths and limitations of AI systems and exercises sound judgment in their use
• Continuously explores new AI capabilities and integrates them into day-to-day work where appropriate
• Uses AI in alignment with company and customer-specific policies, data privacy standards, and ethical guidelines
• Exercises discretion when using AI with sensitive or proprietary information
• Demonstrates awareness of bias, accuracy, and risk considerations when leveraging AI tools