Compliance & Security Analyst

Description

You will be the lead point of contact for the Overwatch Continuous Compliance program, with a portfolio of about 10 customers.

You will advise clients through CMMC 2.0 (Level 2) certification and bring them to full readiness for audit.

You will turn detailed federal requirements into a technical plan that client leaders and IT staff can act on.

Responsibilities

• Write and maintain System Security Plans that document how each NIST 800-171 control is implemented, serving as the reference for the client's security posture.
• Build and track the Plan of Action and Milestones, logging every gap and guiding the client's IT team through fixing it.
• Write security policies that are specific and defensible, based on how the client actually operates rather than generic templates.
• Design and run annual Incident Response and Disaster Recovery tabletop exercises.
• Lead evidence collection and confirm that the client's logs and configurations will satisfy a C3PAO auditor.
• Keep current on relevant federal, state and local laws, along with company policies and procedures, and work in an honest, ethical and professional way.
• Interact with customers in line with the company's customer service standards.
• Promote the company's mission and values through your day-to-day conduct.

Requirements

• Hold a bachelor's degree in a related field, or an equivalent combination of education and experience.
• Advise on splitting CUI into segments to narrow audit scope and cost.
• Verify that encryption modules in VPNs, Wi-Fi and storage meet FIPS 140-2 or 140-3 validation.
• Read network diagrams and spot weaknesses in boundary protection and data flow.
• Know what a passing audit log looks like for MFA, access control and system monitoring.
• Have deep knowledge of CMMC 2.0 Level 2 and NIST SP 800-171.
• Write clear, audit-ready documentation, including SSPs, SOPs and policies.
• Know SOC 2, ISO 27001, HIPAA or GDPR.
• Have used GRC platforms such as Apptega, FutureFeed or Microsoft Purview.
• Hold or be working toward the CCP (CMMC Certified Professional), CISA or Security+ certification.
• Work with C-suite executives and client technical teams throughout a consulting engagement.
• Manage around 10 clients or projects at once without lowering quality or missing milestones.
• Operate well when requirements are unclear and requests come from many directions.
• Handle several projects at the same time and turn business data into clear guidance that improves processes.
• Communicate well, both technically and with business audiences, in writing and in person.

Conditions

This role has no supervisory responsibilities.

The job involves sitting, talking, seeing, hearing and using your hands and arms throughout the day, frequent standing, moving, climbing steps, balancing, stooping, kneeling, crouching or crawling, and occasionally lifting or moving up to 10 pounds.

Reasonable accommodations may be made so people with disabilities can perform the essential functions.

The company is an equal opportunity employer that hires based on qualifications, training, experience and demonstrated performance, and does not discriminate on any basis prohibited by federal or state law.

Benefits

• Benefits are described in the company's US benefits summary.