Cybersecurity GRC Senior Analyst
About The Position
SAIC is seeking a Cybersecurity GRC Senior Analyst to join its Governance, Risk and Compliance (GRC) Team. The position may be remote anywhere in the United States for the right candidate. The role supports enterprise cyber risk management by leading application, system, and vendor risk assessments; validating control effectiveness; coordinating remediation through mitigation plans; and improving the Cybersecurity Risk Management Program. Acting as a second-line-of-defense partner to technical process teams and stakeholders, the analyst supports risk-informed decisions and measurable risk reduction aligned with regulatory and enterprise standards.
Requirements
- Bachelor’s degree in Information Technology or a similar discipline and 5 years of experience, or a master’s degree and 3 years of experience; an additional 4+ years of experience may be considered in lieu of a degree.
- Certifications such as CISA, CISSP, CISM, or Security+.
- Comprehensive understanding and applied experience with cybersecurity frameworks and regulations, including NIST RMF, NIST SP 800-53/171, ISO/IEC 27001, COBIT, COSO, MITRE, ITIL, HITRUST, and SOC reporting.
- Ability to categorize systems and information per FIPS 199 and NIST SP 800-60.
- Strong analytical skills, including the ability to synthesize complex information and defend independent judgments.
- Excellent written and verbal communication skills, including the ability to translate technical risk into business-focused language and narratives.
- Strategic, self-directed work style and effective collaboration and negotiation across diverse stakeholders.
- Demonstrated ability to manage multiple projects, prioritize according to urgency and impact, and meet deadlines.
Nice To Haves
- Working knowledge of ServiceNow and/or other GRC tools.
- Working knowledge of security tools for vulnerability scanning, DLP, endpoint protection, and similar functions.
- Technical proficiency in cybersecurity.
Responsibilities
- Maintain awareness of cybersecurity trends and threats to inform risk mitigation strategies.
- Assist with application and system/infrastructure risk assessments and reassessments, document results, and track remediation to closure.
- Conduct third-party vendor risk assessments and collaborate with procurement, legal, and business owners on risk treatment.
- Conduct supply chain risk management risk and compliance assessments.
- Assist with operational cyber activities, including Carbon Black application whitelisting reviews, processing international travel requests and managing violations, and software assessments and evaluations.
- Select, implement, and assess security controls under NIST SP 800-171 and validate their effectiveness.
- Drive continuous monitoring using NIST SP 800-39 and maintain dashboards and key risk indicators.
- Manage vulnerability and penetration test findings and coordinate with system owners to remediate them within SLAs.
- Author and maintain risk management program documentation, prepare audit evidence, and participate in internal and external audits, including ISO/IEC 27001 and SOC-related audits.
- Recommend updates to cybersecurity policies, standards, and procedures based on control gaps and remediation outcomes.
- Develop and deliver training and guidance to stakeholders to strengthen a risk-aware culture.
- Assist with configuration and maintenance of GRC tooling, such as ServiceNow GRC or equivalent, to support workflow, evidence management, and reporting.
- Collaborate across security, IT, and business teams; escalate material risks to senior leadership with clear risk statements and options.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
