GRC Analyst - DOE/CMMC Compliance Lead (Onsite)

Milestone Technologies, Inc.; Torrance (CA); On-site; USD 110,000 - 124,000; Full time

Benefits offered by this job

On-site parking

Comprehensive benefits

Job summary

Milestone Technologies, Inc. in Torrance, CA is seeking a GRC Analyst to own and drive a cybersecurity compliance program toward DOE Order 205.1D and CMMC 2.0 Level 2 readiness.

This contract role requires translating regulatory requirements into concrete controls across IT/OT, with a focus on CUI protection. The ideal candidate has 7+ years in cybersecurity with 4+ years in GRC, hands-on RMF/NIST work, and strong policy writing and executive communication skills.

Qualifications

• 7+ years in cybersecurity, with 4+ years focused on GRC, compliance or risk management.
• Hands-on experience implementing NIST SP 800-37 (RMF) and NIST SP 800-53 controls, including writing SSPs and POA&Ms.
• Working knowledge of DOE O 205.1D and how it applies to contractor systems.
• Experience with CMMC 2.0 and NIST SP 800-171, including SPRS scoring.
• Demonstrated experience identifying, scoping and protecting CUI, including CUI categories, marking and data‑flow mapping.

Responsibilities

• Interpret DOE O 205.1D requirements and translate into testable security controls.
• Interpret CMMC 2.0 Level 2 practices and map to DOE requirements.
• Advise engineering and IT on impact of systems and architecture on compliance.
• Identify CUI across the business and map data flows and inventories.
• Build a unified control framework cross-mapping multiple standards and document ownership.

Skills

GRC

Regulatory compliance

Risk management

RMF (NIST SP 800-37)

NIST SP 800-53 controls

CMMC 2.0

DOE O 205.1D knowledge

Technical writing

Education

Bachelor's degree in cybersecurity or related field

Tools

Archer

ServiceNow GRC

Hyperproof

Job description

Milestone Technologies, Inc. in Torrance, CA is seeking a GRC Analyst to own and drive a cybersecurity compliance program toward DOE Order 205.1D and CMMC 2.0 Level 2 readiness.

This contract role requires translating regulatory requirements into concrete controls across IT/OT, with a focus on CUI protection. The ideal candidate has 7+ years in cybersecurity with 4+ years in GRC, hands-on RMF/NIST work, and strong policy writing and executive communication skills.