Senior GRC / Third-Party Risk / Data Protection Analyst

Peraton Labs

United States

On-site

USD 104,000 - 166,000

Full time

14 days+

Application generator

An application made for this job — a tailored resume and cover letter that speak straight to the posting.

Get past ATS filters

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Health savings account

Short/long-term disability

Employee assistance program

Parental leave

401(k)

Paid time off (PTO)

Company paid holidays

Job summary

Peraton Labs is seeking a Senior GRC / Third-Party Risk / Data Protection Analyst to own governance, risk and compliance for California health benefit exchange programs. You’ll drive policy creation, POA&M management, and data protection initiatives across vendors and privacy stakeholders.

You will ensure controls meet NIST 800-53 Rev.5, ARC-AMPE, and IRS Publication 1075 requirements, maintaining audit-ready evidence and collaborating with security teams across the engagement.

Qualifications

Bachelor's degree in information systems, cybersecurity, or business with a security concentration; or 4 years of relevant experience in lieu of a degree.
8+ years of experience in security governance, risk, and compliance, third-party risk management, or data protection.
Active CISA or CGRC certification.
Experience mapping controls to NIST SP 800-53 Rev. 5 and managing POA&M lifecycle.
Vendor security risk management experience including questionnaires (SIG/CAIQ) and continuous monitoring.
Hands-on data classification, data-flow mapping, and enterprise DLP platform experience.

Responsibilities

Own policy and control documentation; write policies, procedures, standards, and control narratives.
Test controls, perform gap analysis, and manage POA&Ms through remediation.
Maintain audit-ready evidence libraries and GRC platform records; support annual assessments.
Lead third-party security risk management including vendor due diligence and monitoring.
Lead data protection activities: classify data, apply controls, and enforce encryption and access controls.
Support insider threat program with use-case development and escalation processes.

Skills

Governance, risk & compliance

Third‑party risk management

Data protection

NIST SP 800-53 Rev.5

POA&M management

DLP & encryption

Data classification

Data-flow mapping

GRC platform

Education

Bachelor's degree in information systems, cybersecurity, or business with a security concentration

Tools

GRC platform (e.g., Archer)

DLP tools (e.g., Purview/Netskope/Forcepoint)

Data classification tools

Job description

About Peraton

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world's leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit peraton.com to learn how we're keeping people around the world safe and secure.

About Peraton

About The Role

Position Is Contingent Upon Award**

Peraton Labs is hiring a Senior GRC / Third-Party Risk / Data Protection Analyst to own the governance, risk, and compliance engine of the engagement - policy, control testing, and POA&M management - together with third-party security risk management and the data protection and insider threat program for the California health benefit exchange and the CalHEERS eligibility and enrollment system.

You will work with Covered California security leadership and privacy stakeholders, vendors and their security teams, our on-site security engineering and incident response colleagues, and the independent assessment team, for whom you are the operational-side evidence provider. The goal is that the program's compliance posture against NIST SP 800-53 Rev. 5, ARC-AMPE, and IRS Publication 1075 is real, evidenced, and audit-ready on any given day rather than reconstructed once a year.

What You Will Do In This Role

Own policy and control documentation. Author and maintain security policies, procedures, standards, plans, and control documentation for the environment.

Test controls and close POA&Ms. Perform control testing and gap analysis against NIST SP 800-53 Rev. 5, document deficiencies, and manage POA&Ms through remediation and verified closure.

Keep the program audit-ready. Maintain the control evidence library and GRC platform records, control mappings, and compliance reporting; support the annual independent assessment as the operational-side evidence provider, without acting as an assessor.

Run third-party security risk management. Conduct vendor security due diligence and assessments, contract and control reviews, continuous monitoring, and risk reporting.

Lead data protection. Discover and catalog confidential data, define and apply the data classification scheme, and implement protective controls including DLP, encryption, and access controls.

Support the insider threat program. Contribute to insider threat use cases, monitoring, and escalation procedures in coordination with privacy, HR, and legal stakeholders.

Carry the regulated-data obligations. Support IRS Publication 1075 and ARC-AMPE compliance activities and the privacy obligations of the contract's Privacy Addendum; participate in the on-call incident response rotation.

Qualifications

Required

Bachelor's degree in information systems, cybersecurity, or business with a security concentration. In lieu of a degree, an additional 4 years of relevant experience will be considered.

8+ years of experience in security governance, risk, and compliance, third-party risk management, or data protection.

Active CISA or CGRC certification.

Demonstrated experience performing control assessment and gap analysis against NIST SP 800-53 Rev. 5, and managing the POA&M lifecycle from deficiency identification through closure.

Demonstrated third-party and vendor security risk management experience, including questionnaire-based assessment frameworks such as SIG or CAIQ, contract and control review, and continuous monitoring.

Hands-on experience with data classification and data-flow mapping, and with an enterprise DLP platform such as Microsoft Purview, Netskope, or Forcepoint.

Precise compliance writing ability - policies, control narratives, and deficiency write-ups that withstand external review - and working knowledge of an enterprise GRC platform.

US Citizenship and the abillity to pass a California criminal background clearance (Gov. Code

1043 / 10 CCR

6456) before starting work or accessing any confidential information, PII, PHI, federal tax information, or financial information.

Desired

CIPP/US certification. CRISC, CIPT, or CISM are also valued.

Experience with ARC-AMPE security and privacy requirements.

Experience with IRS Publication 1075 and FTI safeguarding, including participation in a Safeguard Review.

Working knowledge of HIPAA/HITECH and the California Consumer Privacy Act.

Experience with CMS requirements and Authority to Connect support, including Security Assessment Workbooks (SAWs), security assessment reports, and control evidence packages.

Experience in California state government compliance environments.

Experience with health benefit exchange or Medicaid eligibility systems.

Experience with encryption and key management concepts and with insider threat program design.

Details

Target Salary Range: $104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual's experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

Benefits Statement: Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.