Senior GRC & Data Protection Lead

Peraton; Northern (KY); Hybrid; USD 104,000 - 166,000; Full time

Job summary

Peraton is seeking a Senior GRC / Third-Party Risk / Data Protection Analyst to own the governance, risk, and compliance engine for Covered California programs. You will work with security leadership, vendors, and incident response teams to ensure audit-ready posture against NIST SP 800-53 Rev.

5, ARC-AMPE, and IRS 1075. Responsibilities include owning policy and control documentation, testing controls, managing POA&M, and leading third-party security risk management and data protection

Qualifications

• Bachelor's degree in information systems, cybersecurity, or business with security concentration, or 4 extra years of relevant experience.
• 8+ years in security governance, risk, and compliance, third-party risk, or data protection.
• Active CISA or CGRC certification.
• Experience with control assessments against NIST SP 800-53 Rev.5 and POA&M lifecycle management.
• Third-party risk management experience including SIG/CAIQ, contract and control reviews, and continuous monitoring.
• Experience with data classification and enterprise DLP platforms (Purview, Netskope, Forcepoint).
• Precise compliance writing and knowledge of a GRC platform.
• US Citizenship and ability to pass California background clearance.

Responsibilities

• Own policy and control documentation; author and maintain policies, procedures, standards, and controls.
• Test controls and close POA&M insights; manage remediation and verification.
• Keep the program audit-ready with evidence libraries and reporting.
• Run third-party security risk management including vendor assessments and monitoring.
• Lead data protection efforts: data classification, protection controls, and access control.
• Support the insider threat program with use cases and escalation with privacy and HR.
• Carry regulated-data obligations (IRS 1075, ARC-AMPE) and privacy addenda; participate in on-call rotation.

Skills

Governance, risk, and compliance

Third-party risk management

Data protection

Policy and control documentation

POA&M management

NIST SP 800-53 Rev.5

GRC platform knowledge

Cross-functional coordination

Education

Bachelor's degree in information systems, cybersecurity, or business with security concentration

CISA or CGRC certification

CIPP/US, CRISC, CIPT, or CISM (desired)

Tools

Microsoft Purview

Netskope

Forcepoint

Job description

Peraton is seeking a Senior GRC / Third-Party Risk / Data Protection Analyst to own the governance, risk, and compliance engine for Covered California programs. You will work with security leadership, vendors, and incident response teams to ensure audit-ready posture against NIST SP 800-53 Rev.

5, ARC-AMPE, and IRS 1075. Responsibilities include owning policy and control documentation, testing controls, managing POA&M, and leading third-party security risk management and data protection