GRC Analyst - FedRAMP & RMF Compliance Expert

C2 Labs, Inc.; Knoxville (TN); On-site; USD 65,000 - 90,000; Full time

Job summary

C2 Labs, Inc. is seeking a Governance Risk and Compliance (GRC) Analyst to join our security team in Knoxville. You will implement regulatory frameworks (FISMA, FedRAMP, StateRAMP), develop security documentation (SSP, SAP, SAR), and maintain RMF artifacts for FedRAMP cloud environments.

Strong writing and client-facing skills are essential. The role emphasizes creating clear security control statements, coordinating with engineers, and delivering risk assessments and training.

Qualifications

• 1–3 years in IT consulting focusing on RMF.
• US Citizenship and ability to pass a Public Trust background check.
• Strong communication and technical writing skills.
• Familiarity with NIST 800-53, FedRAMP, and StateRAMP.

Responsibilities

• Develop, review, and update security authorization package documentation (SSP, SAP, SAR, POA&M).
• Develop, review, and update Contingency Plan (CP), Incident Response Plan (IRP), and Configuration Management Plan (CMP).
• Conduct Security Impact Assessments (SIAs) on information systems changes.
• Create the Control Implementation Summary and CRM workbook outlining CSP and customer responsibilities.
• Develop and update policies aligning with NIST 800-53 controls.
• Leverage GRC tools to automate SSP creation.
• Review current RMF processes and provide improvement recommendations.
• Develop and deliver Risk Assessment Reports (RAR).
• Provide guidance on FedRAMP and StateRAMP control requirements.
• Deliver training on RMF tasks to stakeholders.

Skills

RMF familiarity

FedRAMP knowledge

GRC documentation

Technical writing

Client communication

Education

Security certifications (CISSP/CISM/CAP)

Tools

GRC tools

NIST templates

Job description

C2 Labs, Inc. is seeking a Governance Risk and Compliance (GRC) Analyst to join our security team in Knoxville. You will implement regulatory frameworks (FISMA, FedRAMP, StateRAMP), develop security documentation (SSP, SAP, SAR), and maintain RMF artifacts for FedRAMP cloud environments.

Strong writing and client-facing skills are essential. The role emphasizes creating clear security control statements, coordinating with engineers, and delivering risk assessments and training.