Senior GRC Analyst: CMMC & NIST Audit Readiness

Cianbro; Pittsfield (ME); On-site; USD 86,450 - 113,750; Full time

Benefits offered by this job

Employee-owned

Equal opportunity employer

Job summary

Cianbro is seeking a Senior Governance, Risk & Compliance (GRC) Analyst to mature the organization’s governance, risk, compliance, and business continuity programs. The role emphasizes CMMC Level 1/2 and NIST SP 800-171, enterprise risk management, and audit readiness with Onspring GRC.

The ideal candidate will translate regulatory requirements into practical controls, work across business and technology teams, and communicate status clearly to diverse audiences.

Qualifications

• Bachelor's degree in Information Systems, Cybersecurity, Information Technology, Business, Risk Management, or related field, or equivalent professional experience.
• 5+ years of experience in governance, risk management, cybersecurity, compliance, audit, or related disciplines.
• Demonstrated experience supporting CMMC and NIST SP 800-171 compliance programs.
• Experience developing and maintaining SSPs, POA&Ms, policies, procedures, risk assessments, and audit evidence repositories.
• Experience administering or supporting a GRC platform, preferably Onspring.
• Strong understanding of risk management, governance principles, and compliance frameworks.
• Working knowledge of security controls, vulnerability management, access management, and networking fundamentals.
• Exceptional written and verbal communication skills.
• Strong organizational, analytical, and problem-solving abilities.
• Ability to manage multiple priorities independently while collaborating effectively across teams.

Responsibilities

• Support and mature the organization's CMMC Level 1 and Level 2 compliance program in alignment with NIST SP 800-171 requirements.
• Maintain compliance documentation, including SSPs, policies, procedures, Plans of Action and Milestones (POA&Ms), and supporting assessment artifacts.
• Coordinate with our Enclave hosting provider to ensure shared responsibility controls are clearly defined, documented, and monitored.
• Partner with control owners, business stakeholders, technology teams, and external assessors to evaluate compliance and track remediation activities.
• Support CMMC assessments, audits, and readiness activities through evidence collection, documentation management, and control validation.
• Monitor regulatory, contractual, and customer compliance requirements and help translate them into actionable business and technical processes.
• Communicate compliance obligations, risks, and program status clearly to both technical and non-technical audiences.
• Support the development and maturation of enterprise governance, risk management, and compliance processes.
• Conduct risk assessments, maintain risk registers, and track remediation activities to improve risk visibility, accountability, and decision-making.
• Coordinate internal audits, external audits, customer assessments, and regulatory reviews, maintaining appropriate evidence and documentation to support audit readiness.
• Partner with stakeholders across the organization to identify risks, address compliance gaps, and strengthen governance practices.
• Support the development, maintenance, and continuous improvement of the organization's Business Continuity and Operational Resilience program.
• Conduct Business Impact Analyses (BIAs) and partner with business stakeholders to identify critical processes, dependencies, recovery requirements, and operational risks.
• Develop, maintain, and test Business Continuity and Disaster Recovery plans, incorporating lessons learned and remediation activities from exercises and testing.
• Manage Business Continuity documentation, workflows, reporting, and program administration within the Onspring GRC platform.
• Support the third-party risk management lifecycle, including vendor onboarding, due diligence reviews, periodic assessments, and ongoing monitoring.
• Assess supplier security, compliance, operational, and business continuity risks.
• Coordinate with Procurement, Legal, Information Technology, and business stakeholders to ensure vendor risk requirements are addressed appropriately.
• Track assessment findings, remediation activities, and risk acceptance decisions.
• Maintain visibility into third-party risk exposure through effective reporting and dashboarding.
• Review vulnerability assessment results, security findings, and remediation recommendations provided by internal teams and service providers.
• Assess technical findings to determine business impact, likelihood, and overall organizational risk.
• Work collaboratively with technical teams to prioritize remediation efforts using a risk-based approach.
• Translate technical security issues into clear business risk statements and recommendations for leadership.
• Assist with evaluating the effectiveness of security controls and identifying opportunities for improvement.

Skills

GRC

CMMC

NIST 800-171

Onspring

Risk assessment

SSPs/POA&Ms

Audit readiness

Vendor risk

Communication

Education

Bachelor's degree in Information Systems/Cybersecurity

Tools

Onspring

Job description

Cianbro is seeking a Senior Governance, Risk & Compliance (GRC) Analyst to mature the organization’s governance, risk, compliance, and business continuity programs. The role emphasizes CMMC Level 1/2 and NIST SP 800-171, enterprise risk management, and audit readiness with Onspring GRC.

The ideal candidate will translate regulatory requirements into practical controls, work across business and technology teams, and communicate status clearly to diverse audiences.