Senior Cyber GRC Analyst

SAIC; United States; Remote; USD 120,000 - 170,000; Full time

Job summary

SAIC is seeking a remote Senior Cyber GRC Analyst to join our Security Operations Services for a major state and local government customer in Texas. The role focuses on cyber risk management, vulnerability assessment, and policy development, with responsibility for security planning and oversight of data center and cloud services.

The candidate will perform RMF-based risk analysis, threat modeling, control implementation, and audits coordination, reporting to the Technical Director.

Qualifications

• Bachelor's Degree in related discipline with five years of related experience; OR, Master's Degree with three years in a related discipline (e.g. Information Security).
• 3-5 years of experience with cyber risk management including the NIST RMF and SP800-53R4.
• 3-5 years of experience with cyber vulnerability and/or risk management; coordination of cyber security assessments and audits.

Responsibilities

• Perform risk analysis using RMF and guidance; identify risks, mitigations, and track through lifecycle.
• Conduct threat modeling and assessments.
• Analyze vulnerability data to determine validity, severity and impact on SAIC customers.
• Coordinate audits (SOC II Type 2) with internal and external parties.
• Design and coordinate implementation of cyber security controls with technical teams.
• Oversee system security plans and policy compliance.
• Interact with peer suppliers to assess risk across systems and technologies.
• Maintain POAMs and oversee task completion by others.
• Baseline cybersecurity compliance assessments against standards.
• Ensure patching per approved schedule and requirements.
• Provide input on new risks and recommended actions.
• Coordinate annual cybersecurity assessments; produce consolidated reports.
• Provide management-level reports and executive briefings.

Skills

NIST RMF

Risk assessment

Threat modeling

Vulnerability management

Audit coordination

Education

Bachelor's Degree in related discipline

Master's Degree in related discipline

Job description

SAIC is seeking a remote Senior Cyber GRC Analyst to join our team providing Security Operations Services for a major state & local government customer located in Texas. It is a program requirement that no program work be performed outside of the United States. This position reports to our Technical Director and is a member of the team providing security planning, management and oversight for data center and cloud services. Working with fellow team members, the Senior Cyber GRC Analyst will be primarily responsible for activities associated with cyber vulnerability management, cyber risk management, threat intelligence, establishment of standards and policy, and supporting related tasks and recurring deliverables.

Primary job responsibilities include:

• Using the NIST Risk Management Framework (RMF) and other standards-based guidance, perform risk analysis including identification, recommendation of mitigations, and tracking of risks throughout their lifecycle
• Perform threat modeling and assessment
• Analyze and assess vulnerability data from scanning tools, cyber intelligence or other resources to determine validity, severity and impact to SAIC customers
• Coordinate audit activities by internal and external parties including SOC II Type 2 audits (external)
• Using NIST SP800-53 r4 and other references, design and coordinate the implementation of cyber security controls with technical teams
• Coordinate and oversee the development of system security plans and compliance with standards and policies
• Interact with peer supplier organizations in the assessment of risk for their systems and technologies, and coordinate risk management and response activities
• Maintain POAMs and supervise the completion of assign tasks and activities by others
• Perform baseline assessments of cybersecurity compliance against documented standards and requirements
• Help to ensure that SAIC and in-scope systems are patched according to approved schedule and requirements
• Provide input and assessment of new risks and recommend actions
• Coordinate annual cybersecurity assessment across multiple vendors and service providers; produce consolidated assessment report
• Provide reports, communication and engagement with stakeholders and management
• Provide senior management and executive briefings, summaries and reports on activities, assessments and cyber security posture
• Coordinate business continuity and disaster recovery activities
• Lead maintenance of policy, procedures, and related job aid documentation

Experience, Education and Certification

Required:

• Bachelor's Degree in related discipline and five (5) years related experience; OR, Master's Degree and three (3) years of experience in a related discipline (e.g. Information Security).
• 3-5 years of experience with cyber risk management including the NIST RMF and SP800-53R4
• 3-5 years of experience with cyber vulnerability and/or risk management3-5 years of experience providing and coordinating cyber security assessments and audits
Actually we need
• tags: the content is a separate line: '3-5 years of experience providing and coordinating cyber security assessments and audits', ensure correct punctuation. Let's replicate correctly.Actually we had erroneously missed: let's just write correct. Let's just do: start each
• Possibly mis-coded; we need to correct. The job description lines: '3-5 years of experience providing and coordinating cyber security assessments and audits'. Let's preserve exactly: '3-5 years of experience providing and coordinating cyber security assessments and audits'All lines inside
• must be strict content.Again I'm listing incorrectly. Hard. Let's scrap this ephemeral confusion.We'll produce final string in the final response, ignoring these concerns.The aim: final JSON."