Senior GRC & Third-Party Risk Lead, Data Protection

Peraton; Herndon (VA); On-site; USD 104,000 - 166,000; Full time

Job summary

Peraton is seeking a Senior GRC / Third-Party Risk / Data Protection Analyst in the United States to own the governance, risk, and compliance engine for the engagement, including policy creation, control testing, and POA&Ms management, and to oversee third-party risk and data protection programs for health‑related contract work.

The role involves working with security leadership, vendors, and incident response teams to ensure an audit-ready posture against NIST SP 800‑53 Rev.

Qualifications

• Bachelor's degree in information systems, cybersecurity, or business with security concentration (or 4 extra years of relevant experience).
• 8+ years in security governance, risk, and compliance, third‑party risk management, or data protection.
• Active CISA or CGRC certification.
• Experience with NIST SP 800‑53 Rev. 5 control assessments and POA&M lifecycle.
• Experience with third‑party/vendor security risk management including SIG/CAIQ frameworks.

Responsibilities

• Own policy and control documentation; write and maintain security policies, procedures, and standards.
• Test controls, perform gap analysis, and manage POA&M remediation and closure.
• Keep program audit-ready by maintaining evidence libraries and control mappings.
• Run third‑party security risk management: vendor due diligence, assessments, reviews.
• Lead data protection: classify data, apply data handling controls including encryption and access controls.
• Support insider threat program and coordinate with privacy, HR, and legal teams.
• Comply with IRS Publication 1075 and ARC‑AMPE obligations and participate in incident response rotation.

Skills

GRC governance

Risk management

Compliance testing

Policy writing

DLP / data protection

Education

Bachelor's degree in information systems or cybersecurity

Tools

NIST SP 800-53 Rev.5

GRC platforms

CAIQ/SIG questionnaires

Microsoft Purview / DLP

Job description

Peraton is seeking a Senior GRC / Third-Party Risk / Data Protection Analyst in the United States to own the governance, risk, and compliance engine for the engagement, including policy creation, control testing, and POA&Ms management, and to oversee third-party risk and data protection programs for health‑related contract work.

The role involves working with security leadership, vendors, and incident response teams to ensure an audit-ready posture against NIST SP 800‑53 Rev.