Senior GRC Officer - Security & Compliance Leader

Penlink; Lincoln (NE); Hybrid; USD 120,000 - 160,000; Full time

Job summary

Penlink is a technology company enabling investigators to solve crimes with secure data management in the United States. This hybrid role sits in Lincoln, NE, and leads governance, risk, and compliance programs across FedRAMP, CMMC, SOC 2, ISO 27001, and related frameworks.

You will coordinate audits, craft essential documentation, and partner with 3PAO/C3PAO assessors to ensure readiness and ongoing compliance.

Qualifications

• 5+ years in governance, risk, compliance, or information security within SaaS/cloud/regulated environments.
• Direct FedRAMP experience including SSP/POA&M and assessment readiness.
• Strong knowledge of NIST SP 800-53 controls and applicability for stakeholders.

Responsibilities

• Independently manage FedRAMP, CMMC 2, SOC 2 Type 2, ISO 27001, TX-RAMP, CJIS workstreams and readiness.
• Lead creation and quality review of SSPs, POA&M, control narratives, policies, procedures, and readiness artifacts; act as primary contact for 3PAO/C3PAO.
• Coordinate implementation/validation of NIST SP 800-53 and CMMC across engineering, cloud, IT, and product; maintain evidence repositories.
• Own risk management, vendor risk assessment, policy governance, access review, and exception management; lead Cloud Vulnerability Task Force.
• Plan and support external audits/certifications; respond to RFIs/RFPs and customer security questionnaires.
• Prioritize multiple workstreams; track remediation; elevate risks; provide status updates to management.
• Conduct internal assessments and gap analyses; recommend remediation actions.
• Provide guidance as a trusted security/compliance reviewer to ensure risks and controls are considered before implementation.

Skills

GRC Leadership

FedRAMP Experience

NIST SP 800-53

Risk Assessment

Audit Coordination

Documentation Quality

Stakeholder Communication

Regulatory Compliance

Job description

Penlink is a technology company enabling investigators to solve crimes with secure data management in the United States. This hybrid role sits in Lincoln, NE, and leads governance, risk, and compliance programs across FedRAMP, CMMC, SOC 2, ISO 27001, and related frameworks.

You will coordinate audits, craft essential documentation, and partner with 3PAO/C3PAO assessors to ensure readiness and ongoing compliance.