Information Security Compliance Analyst

Data Recognition Corporation is seeking an Information Security Compliance Analyst to support its Information Security Team. The role manages and leads risk and compliance activities, including security reviews, audits, GovRAMP compliance, NIST RMF activities, policy maintenance, risk management, business continuity, and security metrics.

Responsibilities:

• Obtain and maintain GovRAMP compliance
• Support Authority to Operate (ATO) approvals for government contracts by adherence to NIST Risk Management Framework (RMF)
• Support cybersecurity efforts to include the development and management of System Security Plan (SSP) documentation, Plans of Action and Milestones (POAMs), assessing and auditing systems security controls, and continuous monitoring activities
• Manage internal and external annual audits (third party and customer)
• GovRAMP
• ISO 27000 series
• SOC II Type 2
• Various customer audits
• Maintain and drive remediation on Plan of Action and Milestones (POAM) items
• Policy and standard development and review
• Mature security risk management practices
• Manage and enhance Business Continuity/Disaster Recovery processes
• Update and maintain security and compliance metrics

Requirements:

• Company cannot provide sponsorship for this position
• 3+ years of Information Security, GRC, audit, or compliance experience
• Working knowledge in NIST 800-53 Rev 5 framework and how to implement and audit against the framework
• General knowledge of the following: Risk Management Framework (RMF), compliance with security technical implementation guides (STIGs), and documenting Plan of Action and Milestones (POA&M)
• Experience managing SOC 2 Type II compliance audits
• Possesses a high level of personal integrity and the ability to discreetly handle sensitive, personal, and classified information
• Must have excellent communication skills and the ability to work well in a team and across the organization, in addition to independently driving initiatives
• Four-year college degree in IT, Computer Science, Cybersecurity, or related fields
• Internal or External Audit experience
• Experience with GovRAMP or FedRAMP certifications
• Experience with Federal Information Security Management Act (FISMA) leveraging National Institute of Standards and Technology (NIST) security controls (NIST 800-53, rev 5)
• Security certification such as Certified Information Security Auditor (CISA) and/or Certified in Risk and Information Security Controls (CRISC)
• Experience with ISO 27001 certification
• Experience supporting and participating in third party vendor security assessments and audits, reviewing audit findings as well as responses to security findings and remediation plans
• Ability to manage cross-functional projects and initiatives as required