Senior GRC & Third-Party Risk Lead – Data Protection

Peraton; Reston (VA); On-site; USD 104,000 - 166,000; Full time

Job summary

Peraton is seeking a Senior GRC / Third-Party Risk / Data Protection Analyst to own the governance, risk, and compliance engine for the engagement, including policy, control testing, POA&Ms, and third-party security risk management. The role covers data protection, insider threat, and privacy obligations across California health benefits programs.

You will collaborate with security leadership, vendors, and incident response teams to maintain an audit-ready posture against NIST 800-53 Rev.

Qualifications

• Bachelor's degree in a relevant field or 4 years of additional experience.
• 8+ years in security governance, risk, and compliance or data protection.
• Active CISA or CGRC certification.
• Experience assessing controls against NIST SP 800-53 Rev. 5 and POA&Ms lifecycle.
• Third-party risk management experience with questionnaire frameworks like SIG/CAIQ.
• Data classification and data-flow mapping with enterprise DLP platforms.
• Precise compliance writing and knowledge of a GRC platform.

Responsibilities

• Own policy and control documentation, including standards and control narratives.
• Test controls, perform gap analysis, and manage POA&Ms through remediation.
• Maintain audit-ready evidence and support independent assessments as evidence provider.
• Lead third-party security risk management, vendor assessments, and continuous monitoring.
• Lead data protection activities: classify data, apply controls, implement encryption and access controls.
• Support insider threat program with use-case development and escalation procedures.
• Support IRS Publication 1075 and ARC‑AMPE compliance activities and privacy addenda obligations.

Skills

Governance & Risk

Policy writing

Vendor risk mgmt

Data protection

DLP platforms

Education

Bachelor's degree in information systems, cybersecurity, or business with security concentration

Tools

NIST SP 800-53 Rev. 5

SIG/CAIQ frameworks

CAIQ

Purview / Netskope / Forcepoint DLP

Job description

Peraton is seeking a Senior GRC / Third-Party Risk / Data Protection Analyst to own the governance, risk, and compliance engine for the engagement, including policy, control testing, POA&Ms, and third-party security risk management. The role covers data protection, insider threat, and privacy obligations across California health benefits programs.

You will collaborate with security leadership, vendors, and incident response teams to maintain an audit-ready posture against NIST 800-53 Rev.