IT Security Risk Auditor / Compliance Specialist/GRC Analyst

sgsconsulting; Lexington (MA); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Software Galaxy Systems, LLC (SGS) is seeking an IT Security Risk Auditor/Compliance Specialist for a 36-month engagement in Lexington, MA. The role requires on-site work initially with potential remote days after ramp-up, and a focus on regulatory compliance including FAR/DFARS and NIST standards.

Interims clearance suffices to start, and the candidate will support governance, policy, reporting, and incident response.

Qualifications

• Experience in risk assessments and compliance auditing.
• Knowledge of RMF, NIST SP 800-53, and STIGs.
• Ability to read and apply NISPOM, FAR/DFARS, and related regulations.

Responsibilities

• Develops and oversees compliance programs and governance policies.
• Conducts internal compliance reviews and documents findings.
• May participate in internal or external audits.
• Recommends policy changes to improve compliance.
• Generates reports and analyzes data on compliance topics.
• Engages with internal and external stakeholders as needed.
• Develops presentations for compliance topics.

Skills

Risk assessments

Compliance auditing

Security reviews

Vulnerability assessments

RMF knowledge

STIGs knowledge

Education

Bachelor’s degree in CS/IT

Job description

Job Description

Job Title: IT Security Risk Auditor / Compliance Specialist/IT Compliance Auditor/ Cybersecurity Compliance Specialist /IT Security Compliance Analyst/ IT Security Auditor

Note: Client is looking for Local Candidate only, final round is going to be onsite interview.

Duration: 36 Months (High Possibility of Extension)

Location: Lexington, MA 02421

Job Description:

Clearance: Interim clearance is sufficient for start

Work Location: This position will be predominantly onsite for the first 3-4 months (probably 4 days/week onsite). After the initial ramp up period, there may be an opportunity for more remote, 2-3 days/week.

Interview Process: Initial zoom interview, second round zoom

Description:

• Develops and oversees compliance programs, supporting compliance efforts, governance/policy, reporting, and incident response.


• Ensures that the organization remains compliant with all regulations and policies as required based on the local and federal requirements, specifically FAR and DFAR regulations.


• Conducts internal compliance reviews and documents findings.


• May participate in internal or external audits.


• Recommends process or policy change to increase compliance or efficiencies.


• Generates reports and analyzes data on applicable compliance related topics.


• Engages with internal stakeholders and any external partners as needed.


• Develops presentations and collateral for compliance related topics.

Other information relevant to the job requirement?

The IT Security Risk Auditor position performs audits of classified and unclassified Information Systems (IS) to ensure that they are being maintained in a compliant manner and are following applicable laws and government regulations, such as National Industrial Security Program Operation Manual (NISPOM) guidelines regarding the protection of classified information systems, National Institute of Standards and Technology (NIST) standards and special publications, Cybersecurity Maturity Model Certification (CMMC), DCSA Assessment and Authorization Process Manual (DAAPM) and Laboratory Information System Security Procedures. The candidate must be knowledgeable in fundamental computer security principles and policies: Security Technical Implementation Guides (STIGs), NIST 800-53/Risk Management Framework (RMF), CNSSI 1253, and DOD Manual 5205.07 Volumes 1-4, NIST SP 800-171 and DAAPM 2.0.

Requirements:

• Bachelor’s degree in computer science, Information Technology, Computer Information Systems, or related field is required with a minimum of seven (7) years’ experience conducting risk assessments.


• Experience in compliance auditing, security reviews, or vulnerability assessments.


• Technical experience and skills, course work completed toward a degree, and industry IT certifications (i.e. CISSP, CISA) may be considered substitutes for education and experience.


• In-depth knowledge of information security principles and policies such as Risk Management Framework (RMF) as presented by the National Institute of Standards and Technology (NIST), NIST SP 800-171 and Security Technical Implementation Guides (STIGs).


• The ability to read, understand and apply government regulation, policies and procedure such as the National Industrial Security Program Operating Manual (NISPOM), 32 CFR Part 117, FAR/DFARS Safeguarding CUI series (252.***-7012, etc.), computer security principles and policies, to include, Security Technical Implementation Guides (STIGs) and NIST 800-53 / Risk Management Framework (RMF) and NIST SP 800-171.

Working experience directly related to Assessment and Authorization using at least one of the following:

• NIST 800-53/Risk Management Framework (RMF)


• Joint Special Access Program (SAP) Implementation Guide


• NIST SP 800-171 Understanding of CMMC Framework


• National Industrial Security Program Operating Manual (NISPOM) Chapter 8

Preferred:

• Information Assurance Certifications preferred (CISSP/CISA, Security+, CCP/CCA, or other industry-recognized Certification that validate knowledge in Cybersecurity framework or equivalent).


• Direct experience with DCSA facility compliance reviews and security audits.

Company Description

Software Galaxy Systems, LLC (SGS) is an award-winning Contingent Workforce Services firm providing a broad range of integrated suite of services through a global delivery platform. SGS brings innovative talent management strategies to empower its clients to stay focused on growth of their core competencies. SGS has developed a comprehensive process-oriented methodology to manage high-volume contingent labor, payroll services and SOW’s for today’s competitive landscape.

SGS is proud of the partnerships it has built with its clients, MSP’s, and employees which has allowed it to deliver unparalleled service to its wide-ranging customer base. SGS is a certified minority owned enterprise that provides innovative yet practical solutions, from concept through execution. We combine technology with strategy and aim to deliver results today that endure tomorrow. SGS’ client centric approach delivers unparalleled value with vastly responsive, streamlined and highly process oriented workforce solutions.

SGS has been awarded and acknowledged by leading MSP’s (i.e., KellyOCG, TAPFIN, Guidant Global, etc.) for its exemplary performance in the contingent workforce space.