Remote GRC Analyst: CMMC, FedRAMP, SOC 2 & PCI

Virtru; Washington (District of Columbia); Hybrid; USD 130,000 - 170,000; Full time

Benefits offered by this job

Flexible PTO policy

Learning & Development stipend

Headspace access

401K contribution

Stock options

Job summary

Virtru seeks a Security Governance Risk & Compliance Analyst to lead compliance programs across FedRAMP, SOC 2, PCI DSS, HIPAA, GDPR, and related standards. You’ll manage controls for cloud and SaaS platforms, design automation for evidence collection, and drive risk assessments across business units.

You’ll own CMMC integration, support vendor security reviews, and collaborate with cross-functional teams to deliver secure, scalable solutions while enabling secure sharing of data.

Qualifications

• Minimum of 5+ years of information security, IT audit and/or IT risk management, or GRC analyst/engineer experience.
• Deep understanding of CMMC, NIST 800-53 & 800-171, FedRAMP, SOC 2, PCI, and other privacy compliance frameworks.
• Technical acumen with modern cloud technologies (AWS, GCP, Azure) and familiarity with GRC tools and SIEMs.
• Strong relationship-building skills to translate risk to various levels of the organization.
• Experience training and coaching teams to become better security and privacy practitioners.

Responsibilities

• Manage and implement complex controls frameworks for large systems including cloud infrastructure and SaaS services (GCP, AWS, GitHub, Okta).
• Design and develop automation solutions for evidence collection across cloud infrastructure, endpoints, and SaaS services.
• Conduct risk assessments across business units, identify findings, and recommend remediation strategies.
• Participate in incident response activities, providing risk analysis and remediation support.
• Assist or implement automated controls to support risk mitigation across units.
• Incorporate CMMC certification into Virtru’s compliance assessments and monitoring.
• Facilitate vendor onboarding and annual review processes by evaluating security of partners.
• Enhance the team with your individuality, spirit, and love of learning.

Skills

InfoSec experience

GRC/program governance

Risk management

Cloud platforms

Stakeholder communication

Tools

Hyperproof

Vanta

Drata

Datadog

Splunk

AWS

GCP

Azure

Job description

Virtru seeks a Security Governance Risk & Compliance Analyst to lead compliance programs across FedRAMP, SOC 2, PCI DSS, HIPAA, GDPR, and related standards. You’ll manage controls for cloud and SaaS platforms, design automation for evidence collection, and drive risk assessments across business units.

You’ll own CMMC integration, support vendor security reviews, and collaborate with cross-functional teams to deliver secure, scalable solutions while enabling secure sharing of data.