Senior GRC & Data Protection Analyst — Third-Party Risk

Peraton Labs; United States; On-site; USD 104,000 - 166,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Health savings account

Short/long-term disability

Employee assistance program

Parental leave

401(k)

Paid time off (PTO)

Company paid holidays

Job summary

Peraton Labs is seeking a Senior GRC / Third-Party Risk / Data Protection Analyst to own governance, risk and compliance for California health benefit exchange programs. You’ll drive policy creation, POA&M management, and data protection initiatives across vendors and privacy stakeholders.

You will ensure controls meet NIST 800-53 Rev.5, ARC-AMPE, and IRS Publication 1075 requirements, maintaining audit-ready evidence and collaborating with security teams across the engagement.

Qualifications

• Bachelor's degree in information systems, cybersecurity, or business with a security concentration; or 4 years of relevant experience in lieu of a degree.
• 8+ years of experience in security governance, risk, and compliance, third-party risk management, or data protection.
• Active CISA or CGRC certification.
• Experience mapping controls to NIST SP 800-53 Rev. 5 and managing POA&M lifecycle.
• Vendor security risk management experience including questionnaires (SIG/CAIQ) and continuous monitoring.
• Hands-on data classification, data-flow mapping, and enterprise DLP platform experience.

Responsibilities

• Own policy and control documentation; write policies, procedures, standards, and control narratives.
• Test controls, perform gap analysis, and manage POA&Ms through remediation.
• Maintain audit-ready evidence libraries and GRC platform records; support annual assessments.
• Lead third-party security risk management including vendor due diligence and monitoring.
• Lead data protection activities: classify data, apply controls, and enforce encryption and access controls.
• Support insider threat program with use-case development and escalation processes.

Skills

Governance, risk & compliance

Third‑party risk management

Data protection

NIST SP 800-53 Rev.5

POA&M management

DLP & encryption

Data classification

Data-flow mapping

GRC platform

Education

Bachelor's degree in information systems, cybersecurity, or business with a security concentration

Tools

GRC platform (e.g., Archer)

DLP tools (e.g., Purview/Netskope/Forcepoint)

Data classification tools

Job description

Peraton Labs is seeking a Senior GRC / Third-Party Risk / Data Protection Analyst to own governance, risk and compliance for California health benefit exchange programs. You’ll drive policy creation, POA&M management, and data protection initiatives across vendors and privacy stakeholders.

You will ensure controls meet NIST 800-53 Rev.5, ARC-AMPE, and IRS Publication 1075 requirements, maintaining audit-ready evidence and collaborating with security teams across the engagement.