Risk and Compliance Analyst

Team (Project) Introduction

We are recruiting for a range of cybersecurity opportunities supporting federal customers, focused on strengthening enterprise security architecture, systems engineering, and the secure implementation of technologies across the environment.

The work involves applying established cybersecurity standards, guidelines, and frameworks to help translate organizational and business requirements into secure, scalable technical solutions. Team members may contribute to security architecture and engineering efforts, implementation guidance, technical analysis, and the development of repeatable approaches that support the consistent deployment and operation of secure technologies across complex enterprise environments.

Systems security engineering is an important component of this work, with an emphasis on incorporating security and stakeholder protection requirements throughout the system development life cycle, from concept and design through development, production, sustainment, and decommissioning. The team will apply established systems engineering and cybersecurity principles to help protect systems, applications, data, and supporting technologies.

Ultimately, this work supports the broader mission to strengthen its cybersecurity posture, reduce organizational risk, and protect critical systems and information from evolving cyber threats, including external adversaries and insider threats.

9^th Way Insignia is looking for an Engineer, 3, Risk and Compliance Analyst to join this team.

Professional Level Information:
An Engineer, 3 typically plans and directs research or development work on complex projects, along with engaging various parties in design and development. Costs and recommendations of new components may also involve part of the job scope. Performs multiple engineering-related tasks in various assignments within the project and firm. An Engineer, 3 oversees the design, development, implementation, and analysis of technical products and systems.  An Engineer, 3 has broad knowledge of engineering procedures and assists in the resolution of complex problems.  An Engineer, 3 has strong technical skills and background, a knack for learning new technologies, and a blend of good problem-solving and innovation needed to resolve a wide variety of technical production challenges.

Responsibilities:  

• Perform and support comprehensive cybersecurity risk assessments for information systems, applications, platforms, technologies, processes, and enterprise initiatives.
• Identify, analyze, evaluate, document, and monitor cybersecurity risks, vulnerabilities, control gaps, compliance deficiencies, and residual risks.
• Develop and implement risk-management processes and programs, including risk identification, assessment, prioritization, mitigation, monitoring, and reporting.
• Develop risk-mitigation strategies and corrective-action recommendations that are technically feasible, actionable, and aligned with Government risk tolerance and mission requirements.
• Monitor identified risks throughout the system and program lifecycle and track the status and effectiveness of approved mitigation actions.
• Support continuous monitoring activities to provide ongoing visibility into cybersecurity risk, compliance posture, control implementation, and outstanding remediation requirements.
• Perform compliance assessments against applicable Federal cybersecurity requirements, VA policies, organizational standards, and approved security baselines.
• Assess systems and cybersecurity activities for compliance with applicable NIST standards, OMB mandates, VA cybersecurity requirements, and other Federal security frameworks identified within the program.
• Support risk-management activities aligned with NIST SP 800-53 and the NIST Cybersecurity Framework.
• Evaluate compliance findings and provide clear recommendations supporting risk-based decisions regarding system accreditation and authorization.
• Conduct and support internal and external cybersecurity audits, assessments, inspections, and reviews.
• Coordinate with auditors, assessors, Government representatives, cybersecurity SMEs, system owners, engineers, and other stakeholders throughout audit and assessment activities.
• Collect, review, organize, and validate supporting evidence requested during audits and assessments, including policies, procedures, system documentation, security reports, configuration information, logs, diagrams, and other technical artifacts.
• Evaluate audit findings and develop remediation strategies, corrective actions, responsible-party assignments, and resolution timelines.
• Track audit and compliance findings through resolution and verify that corrective actions adequately address identified deficiencies.
• Support annual FISMA/FICAM audit activities and assist in developing actionable remediation recommendations for identified findings.
• Develop and maintain Remediation Reports documenting audit findings, recommended corrective actions, responsible parties, mitigation strategies, and planned resolution timelines.
• Develop and maintain Security Risk Analysis Reports that identify, evaluate, monitor, and communicate system-security risks.
• Support development of Specialized Security Posture Reports evaluating the risks associated with new and emerging technologies such as Artificial Intelligence, Cloud Security, Post-Quantum Cryptography, medical devices, and Internet-of-Things technologies.
• Assess changes in technologies, systems, regulatory requirements, and Government mandates to determine potential risk and compliance impacts.
• Perform security architecture and compliance gap analyses to identify differences between existing implementations and required VA or Federal security requirements.
• Document compliance gaps and recommend mitigation strategies consistent with Government security policies and enterprise risk tolerance.
• Review security configuration and baseline-assessment findings to determine compliance status, deviations, risk implications, and required remediation actions.
• Support requirements traceability between security controls, architectural requirements, system implementation, evidence, and Authority to Operate (ATO) activities.
• Develop and maintain Requirements Traceability Matrices (RTMs) supporting accreditation, authorization, and compliance activities.
• Support Federal Assessment and Authorization (A&A), Risk Management Framework (RMF), and ATO processes as applicable to assigned systems and initiatives.
• Assist system owners and technical teams with interpreting cybersecurity requirements and determining appropriate evidence needed to demonstrate compliance.
• Develop, review, maintain, and support enforcement of cybersecurity policies, procedures, standards, guidelines, and governance documentation.
• Evaluate existing policies and procedures to identify gaps, inconsistencies, or changes needed to maintain alignment with evolving regulatory and organizational requirements.
• Monitor relevant regulatory, policy, and security-requirement changes and assess their potential impact on VA systems and cybersecurity programs.
• Identify and report compliance issues, material deviations, and areas of increased risk to appropriate program and Government stakeholders.
• Prepare risk and compliance information suitable for technical teams, program managers, Government leadership, auditors, and other non-technical stakeholders.
• Develop reports, briefings, dashboards, risk summaries, compliance status updates, and other materials communicating cybersecurity posture and remediation progress.
• Maintain accurate and auditable records of risk decisions, findings, mitigation plans, compliance evidence, corrective actions, and closure status.
• Coordinate with appropriate Government and regulatory stakeholders regarding compliance issues, assessments, findings, and remediation actions.
• Support Government audit and inspection activities by ensuring requested information and documentation are provided accurately and in a timely manner.
• Monitor adherence to approved security policies and requirements and escalate significant compliance issues when necessary.
• Support third-party and supplier risk-management activities where assigned, including evaluation of vendor cybersecurity risk and compliance posture.
• Assist in developing risk-assessment criteria, scoring methodologies, and risk thresholds for evaluating third-party or supplier cybersecurity risk.
• Support cybersecurity supply-chain risk-management activities involving vendor assessments, third-party risk, and regulatory compliance.
• Collaborate with cybersecurity architects, security engineers, DevSecOps personnel, program managers, system owners, technical SMEs, and other stakeholders to integrate risk and compliance requirements throughout the technology lifecycle.
• Participate in technical reviews, governance forums, risk meetings, audit meetings, engineering working groups, and other activities requiring cybersecurity risk or compliance expertise.
• Promote a risk-based approach to cybersecurity decision-making, balancing security requirements, mission needs, operational constraints, and remediation priorities
• May require occasional on-site visits

Requirements:

• Minimum of 7 years of Information Security Experience of which at least 5 years are of risk and compliance experience at a large company or Government agency similar in size/scope to GSA, IRS, DoD or VA. 
• An advanced degree (e.g. Master’s or PhD) in related field may substitute for up to 2 years of the required experience. 
• Expertise in risk management, compliance, audit, or related roles within an organization. 
• Expertise conducting internal and external audits to assess compliance with regulatory requirements and organizational policies. 
• Expertise developing and implementing risk management programs, including risk assessments, risk mitigation strategies, and continuous monitoring.
• Expertise policy development, documentation, and enforcement.
• Expertise handling and reporting compliance issues and coordinating with regulatory bodies. 
• Up to two travel times per year

Preferred/Desired:

• Bachelor’s degree in Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields. 
• CASP+ (SecurityX), CCISO, CISA, CISM, CISSP, CISSP-ISSAP, CISSP-ISSEP, GCED, GCIH, GSLC, CCNP Security