GRC Analyst – Public Sector

Jobtailor; California (MO); On-site; USD 120,000 - 180,000; Full time

Job summary

Jobtailor is seeking a seasoned Security Compliance professional to own governance, risk, and compliance for our public sector initiatives. You will drive FedRAMP/GovRAMP programs, build automated evidence pipelines, and coordinate with auditors to secure certifications.

The role requires strong technical writing, cross-functional collaboration with engineering and sales, and the ability to manage multiple priorities in a dynamic environment. A U.S. passport or clearance eligibility is preferred.

Qualifications

• 4+ years in cybersecurity, compliance, or identity-management.
• Experience with FedRAMP, GovRAMP, or continuous monitoring and POA&M management.
• Direct experience with FedRAMP, GovRAMP, and NIST (800-53/800-63/800-171).
• Ability to execute continuous monitoring, remediation, and reporting.
• Ability to design and improve repeatable compliance processes.
• Customer-facing experience and ability to write persuasively for a customer audience.
• U.S. Person and able to obtain a U.S. OPM NACI clearance.

Responsibilities

• Own hands-on governance, risk, and compliance operations for public sector business.
• Coordinate third-party assessment organizations and respond to auditor requests.
• Maintain FedRAMP and GovRAMP controls aligned with NIST 800-53 rev.5.
• Prepare System Security Plan and appendices for certifications.
• Build and maintain POA&M, compliance trackers, and status reports.
• Replace manual evidence collection with AI-driven, system-generated evidence.
• Design automated, continuous monitoring using integrations and real-time data pipelines.
• Coordinate vulnerability management from identify to remediation and verification.
• Coordinate access reviews, incident response exercises, and contingency plan testing.
• Design automated validation mechanisms and FedRAMP training programs.
• Conduct internal reviews of logged events; escalate gaps and report trends.
• Develop automation-first, AI-enabled compliance workflows (OSCAL).
• Partner with engineering teams to integrate structured compliance data.
• Monitor regulatory trends and perform gap analyses.
• Support public sector sales as a security SME and craft compliance content.
• Support external communications related to certifications and approvals.

Skills

Cybersecurity

Compliance

Identity Management

Written Communication

Adaptability

Customer-Facing Experience

Multi-Priority Management

Education

CISSP Certification

CISM Certification

CISA Certification

IAPP Certification

Tools

Wiz

Burp Suite

AWS Native Services

Telemetry Integrations

Real-Time Data Pipelines

Job description

• Own hands-on execution of governance, risk, and compliance operations for Socure’s public sector business
• Coordinate third-party assessment organization assessments and respond to auditor evidence and documentation requests
• Maintain FedRAMP and GovRAMP controls and documentation aligned with NIST SP 800-53 rev. 5 and related frameworks
• Prepare certification and authorization packages, including the System Security Plan and appendices
• Build and maintain POA&M, compliance trackers, procedures, and status-reporting artifacts
• Replace manual evidence collection with system-generated, API-driven, and continuously validated evidence
• Design and evolve automation-first continuous monitoring using integrations, telemetry, and real-time data pipelines
• Coordinate vulnerability management from identification through remediation and verification using tools such as Wiz, Burp Suite, and AWS native services
• Coordinate access reviews, incident response exercises, and contingency plan testing
• Design automated access validation mechanisms and deliver FedRAMP training programs
• Conduct internal reviews of logged events and control activities; escal gaps and report trends, risks, and remediation progress
• Develop automation-first, AI-enabled workflows and machine-readable compliance documentation such as OSCAL
• Partner with automation and engineering teams to integrate structured compliance data into risk management and monitoring systems
• Monitor regulatory and industry trends and perform gap analyses
• Support public sector sales as a security subject matter expert and create customer-facing compliance and RFP/RFx content
• Support external communications related to security certifications and authorizations

Requirements

• 4+ years of hands-on cybersecurity, compliance, or identity-management experience
• Demonstrated personal execution of FedRAMP, GovRAMP, or comparable continuous-monitoring work, including running scans, building or maintaining a POA&M, and preparing deviation requests
• Direct experience with FedRAMP, GovRAMP, and NIST frameworks (800-53, 800-63, 800-171)
• Ability to execute continuous monitoring, vulnerability remediation, and compliance reporting
• Ability to design and improve repeatable compliance processes
• Strong written communication and ability to write persuasively for a customer audience
• Ability to manage multiple priorities and adapt to changing requirements
• Demonstrated customer-facing experience and exposure to product or sales positioning
• Must be a U.S. Person (U.S. Citizen or U.S. Permanent Resident)
• Must reside in the United States
• Able to obtain a U.S. OPM NACI clearance
• Preferred: experience in regulated industries and knowledge of GDPR, CCPA, and NIST standards
• Preferred: professional certifications such as CISSP, CISM, CISA, or IAPP
• Preferred: hands-on contribution to FedRAMP, GovRAMP, and NIST 800-63/171 initiatives
• Preferred: continuous monitoring, vulnerability management, policy updates, and audit coordination experience

Core Competencies

Demonstrates expertise in governance, risk, and compliance operations, with a strong focus on FedRAMP, GovRAMP, and NIST frameworks. Capable of executing continuous monitoring, vulnerability management, and compliance reporting while effectively communicating with stakeholders.

Highest-signal resume keywords

• FedRAMP Compliance
• NIST SP 800-53
• Continuous Monitoring
• Vulnerability Management
• Cybersecurity Experience

Hard Skills

• Governance Operations
• Risk Management
• Compliance Reporting
• Automation-First Monitoring
• API-Driven Evidence Collection
• System Security Plan Preparation
• POA&M Maintenance
• Internal Review Execution
• Gap Analysis
• Incident Response Coordination

Soft Skills

• Strong Written Communication
• Persuasive Writing
• Adaptability
• Customer-Facing Experience
• Multi-Priority Management

Certifications & Qualifications

• CISSP
• CISM
• CISA
• IAPP

Industry Keywords

• Governance Risk Compliance
• Public Sector
• Regulated Industries
• GDPR
• CCPA

Tools & Technologies

• Wiz
• Burp Suite
• AWS Native Services
• Telemetry Integrations
• Real-Time Data Pipelines