Onsite GRC Analyst: FedRAMP & Federal Compliance

NextgenID; Fairfax, Northern (VA, KY); Hybrid; USD 75,000 - 95,000; Full time

Job summary

NextgenID is hiring a GRC Analyst to manage compliance documentation, evidence, and audit support for FedRAMP, Kantara, and UK identity programs. The role is onsite at Fairfax, VA, with a strong focus on evidence, questionnaire responses, and remediation tracking.

You will own control documentation, run the operational side of certifications, and coordinate with DevSecOps and vendors to keep POA&M and vulnerability logs current. The position reports to the GRC Lead and requires U.S. citizenship.

Qualifications

• Two or more years in GRC, security compliance, audit support, or a closely related role.
• Working knowledge of NIST SP 800-53 and/or NIST SP 800-63, ISO 27001, or SOC 2.
• Experience gathering evidence and maintaining compliance documentation.
• Experience with vulnerability or POA&M tracking and remediation coordination.
• Familiarity with vulnerability tooling (Qualys or Nessus) and evidence / GRC platforms (Vanta or similar).
• Strong writing and documentation skills for policies, procedures, and questionnaire responses.
• Highly organized and detail‑oriented, able to manage many concurrent items.
• Discreet and reliable with sensitive security and compliance information.
• Must be able to work onsite in Fairfax, VA; U.S. citizen (FedRAMP / federal customer).

Responsibilities

• Compliance Documentation & Evidence — keep the record current and audit‑ready.
• Maintain control documentation, policies, and procedures, and migrate evidence into Vanta.
• Gather and organize evidence from engineering, DevSecOps, and operations leads.
• Convert implemented controls into machine‑readable (OSCAL / JSON) format for FedRAMP submission.
• Authorization & Assessment Support — run the operational side of our certifications.
• Refine and maintain the UK DVS / DIATF documentation package and scoping forms.
• Prepare Kantara assessment materials (SoCA, S3A, KAR) and the Rev 4 gap working draft.
• Coordinate assessment and pentest logistics, scheduling, and evidence with assessors and leads.
• Vulnerability & POA&M Tracking — keep the remediation record honest.
• Produce the monthly POA&M from Qualys findings using the FedRAMP template.
• Track vulnerability remediation and compensating controls with the RedTeam / DevSecOps leads.
• Maintain vulnerability and vendor‑risk evidence logs (for example, the BeyondTrust remediation log).
• Customer & Vendor Assurance Support — answer the questionnaires and support vendor risk.
• Complete security questionnaires (for example, CCRA and customer InfoSec assessments) consistent with prior responses.
• Support third‑party and vendor risk assessments and evidence requests.
• Route completed responses to the GRC Lead and management for review before submission.
• Research & Program Support — support the wider compliance effort.
• Provide compliance and privacy research to the document and product teams.
• Support ADA / Section 508 assessments and international import certification documentation (BIS, WPC, ATA Carnet).
• Help configure and maintain GRC tooling (Vanta) and keep the compliance calendar updated.

Skills

GRC experience

Security compliance

Audit support

Evidence gathering

POA&M tracking

Vulnerability tooling

Vanta experience

Documentation writing

Discretion with sensitive info

Tools

Qualys

Nessus

Vanta

OSCAL/JSON

Job description

NextgenID is hiring a GRC Analyst to manage compliance documentation, evidence, and audit support for FedRAMP, Kantara, and UK identity programs. The role is onsite at Fairfax, VA, with a strong focus on evidence, questionnaire responses, and remediation tracking.

You will own control documentation, run the operational side of certifications, and coordinate with DevSecOps and vendors to keep POA&M and vulnerability logs current. The position reports to the GRC Lead and requires U.S. citizenship.