GRC Analyst

Milestone Technologies, Inc.; Torrance (CA); On-site; USD 110,000 - 124,000; Full time

Benefits offered by this job

On-site parking

Comprehensive benefits

Job summary

Milestone Technologies, Inc. in Torrance, CA is seeking a GRC Analyst to own and drive a cybersecurity compliance program toward DOE Order 205.1D and CMMC 2.0 Level 2 readiness.

This contract role requires translating regulatory requirements into concrete controls across IT/OT, with a focus on CUI protection. The ideal candidate has 7+ years in cybersecurity with 4+ years in GRC, hands-on RMF/NIST work, and strong policy writing and executive communication skills.

Qualifications

• 7+ years in cybersecurity, with 4+ years focused on GRC, compliance or risk management.
• Hands-on experience implementing NIST SP 800-37 (RMF) and NIST SP 800-53 controls, including writing SSPs and POA&Ms.
• Working knowledge of DOE O 205.1D and how it applies to contractor systems.
• Experience with CMMC 2.0 and NIST SP 800-171, including SPRS scoring.
• Demonstrated experience identifying, scoping and protecting CUI, including CUI categories, marking and data‑flow mapping.

Responsibilities

• Interpret DOE O 205.1D requirements and translate into testable security controls.
• Interpret CMMC 2.0 Level 2 practices and map to DOE requirements.
• Advise engineering and IT on impact of systems and architecture on compliance.
• Identify CUI across the business and map data flows and inventories.
• Build a unified control framework cross-mapping multiple standards and document ownership.

Skills

GRC

Regulatory compliance

Risk management

RMF (NIST SP 800-37)

NIST SP 800-53 controls

CMMC 2.0

DOE O 205.1D knowledge

Technical writing

Education

Bachelor's degree in cybersecurity or related field

Tools

Archer

ServiceNow GRC

Hyperproof

Job description

High tech energy start up in Torrance seeking a GRC Analyst to own a cybersecurity compliance program and lead it to authorization under DOE Order 205.1D and/or CMMC 2.0 Level 2.

Pay – 80-90/hr, - Please let me know what you are seeking.

W2 ONLY Six+ Month Contract

100% onsite, Torrance, CA – dedicated parking.

MUST BE A U.S. Person status as defined by ITAR (22 CFR 120.15), due to access to export-controlled technical data.

We are seeking a GRC Analyst to own a cybersecurity compliance program and lead it to authorization under DOE Order 205.1D and/or CMMC 2.0 Level 2. This person translates regulatory requirements into concrete security and technology controls, maps the company’s IT, OT and security infrastructure to those controls, and drives remediation through assessment.

A core part of the role is identifying, classifying and protecting Controlled Unclassified Information (CUI), since CUI scope determines the boundary for CMMC and drives much of the DOE control set. The GRC Lead works across IT, engineering, legal, contracts and leadership, and is equally comfortable reading a DOE directive, building a control crosswalk, and explaining residual risk to executives.

Key Responsibilities

Regulatory Interpretation and Control Design

• Interpret DOE O 205.1D requirements and translate each into specific, testable security and technology controls for the company’s environment.
• Interpret CMMC 2.0 Level 2 practices (NIST SP 800-171 Rev. 2) and identify where they overlap with or differ from DOE requirements.
• Advise engineering and IT on how proposed systems, vendors and architecture changes affect compliance.

CUI Identification and Classification

• Identify CUI across the business, using the NARA CUI Registry, DoD CUI program guidance (DoDI 5200.48) and DOE CUI policy (DOE O 471.7).
• Review contracts, DD Form 254s, DFARS clauses and customer guidance to determine which data is CUI, its category (e.g., Export Controlled, Critical Infrastructure, Nuclear), and any dissemination controls.
• Build and maintain a CUI data inventory and data-flow maps showing where CUI is created, stored, processed and transmitted.
• Define the CUI enclave / assessment boundary and categorize assets (CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, Out-of-Scope) per CMMC scoping guidance.
• Establish marking, handling, storage, transmission and destruction procedures for CUI, including export-controlled information (ITAR/EAR, 10 CFR 810) where applicable.
• Train employees and data owners to recognize, mark and handle CUI correctly, and address spills or mishandling incidents.

Control Mapping and Crosswalks

• Map IT, OT and security infrastructure (networks, identity, endpoints, cloud, applications, data flows) to DOE O 205.1D, NIST SP 800-53 Rev. 5 controls, and NIST CSF 2.0 functions and categories.
• Build and maintain a unified control framework and crosswalk across DOE O 205.1D, NIST SP 800-53, NIST SP 800-171 / CMMC 2.0 and NIST CSF 2.0, so one control satisfies many requirements.
• Document control ownership, implementation status and evidence location for every mapped control.

Risk Management Framework (NIST SP 800-37)

• Run the RMF lifecycle: prepare, categorize, select, implement, assess, authorize and monitor.
• Categorize systems (FIPS 199) and define authorization boundaries.
• Author and maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), risk assessments and authorization packages.
• Establish continuous monitoring and track risk acceptance decisions.

Program Leadership toward DOE 205.1D / CMMC Certification

• Perform gap assessments against DOE O 205.1D and CMMC 2.0 Level 2, then build a prioritized, resourced remediation roadmap.
• Lead the company through readiness reviews, C3PAO or DOE assessments, and closure of findings.
• Report program status, risk posture and milestones to executive leadership.
• Coordinate with DOE program offices, contracting officers and prime contractors on flow-down requirements (e.g., DFARS 252.204-7012, -7019, -7020, -7021).

Governance, Policy and Operations

• Write and maintain the security policy and procedure set aligned to the unified framework.
• Manage third-party and supply chain risk (SCRM), including vendor assessments and confirming vendors handling CUI meet required controls (e.g., FedRAMP Moderate or equivalent).
• Own the evidence collection process and audit-ready documentation.
• Run security awareness and role-based training related to compliance obligations.
• Track changes to DOE directives, NIST publications and CMMC rules, and update controls accordingly.

Required Qualifications

• 7+ years in cybersecurity, with 4+ years focused on GRC, compliance or risk management.
• Hands‑on experience implementing NIST SP 800-37 (RMF) and NIST SP 800-53 controls, including writing SSPs and POA&Ms.
• Working knowledge of DOE O 205.1D (or its predecessor 205.1C) and how it applies to contractor systems.
• Experience with CMMC 2.0 and NIST SP 800-171, including SPRS scoring.
• Demonstrated experience identifying, scoping and protecting CUI, including CUI categories, marking and data‑flow mapping.
• Proven ability to map technical infrastructure (network, identity, cloud, endpoint) to control frameworks and NIST CSF 2.0.
• Track record of leading an organization through a formal audit, assessment or authorization (ATO, CMMC, FedRAMP, ISO 27001 or similar).
• Strong technical writing and the ability to explain risk clearly to engineers and executives.

Preferred Qualifications

• Certifications: CISSP, CISM, CGRC (formerly CAP), CMMC Certified Professional (CCP) or Certified Assessor (CCA), CRISC.
• Experience in nuclear, energy, national laboratory or other DOE‑contractor environments.
• Familiarity with export control (ITAR, EAR, 10 CFR 810) and its overlap with CUI.
• Familiarity with OT/ICS security (NIST SP 800-82, IEC 62443) and NRC cyber requirements (10 CFR 73.54) where relevant.
• Experience with data discovery/classification and DLP tools (e.g., Microsoft Purview) and GRC platforms (e.g., Archer, ServiceNow GRC, Hyperproof).
• Bachelor’s degree in cybersecurity, computer science, engineering or a related field, or equivalent experience.

This position is designated for Export Control Screening (ECS) and may require access to hardware, software, technology, technical data, facilities, systems, or customer environments subject to U.S. export control laws, including the EAR and, where applicable, the ITAR. Following an offer, the selected candidate must complete Milestone Technologies’ Export Control Compliance Verification Form and certification and provide any requested supporting documentation. Any assignment or continued access to controlled items is contingent upon the company’s determination that the individual is legally authorized to receive such access or that any required government authorization can be obtained. This review is conducted solely for export‑control compliance purposes and is separate from Form I‑9 employment eligibility verification.

The estimated pay range for this position is USD $80.00/hr - USD $90.00/hr. Exact compensation and offers of employment are dependent on job‑related knowledge, skills, experience, licenses or certifications, and location. We also offer comprehensive benefits. The Talent Acquisition Partner can share more details about compensation or benefits for the role during the interview process.