Risk and Compliance Analyst

9th Way Insignia

2d•$98,135 - $115,000

About The Position

9th Way Insignia is seeking an Engineer, 3, Risk and Compliance Analyst to join a team focused on strengthening enterprise security architecture, systems engineering, and the secure implementation of technologies for federal customers. This role involves applying cybersecurity standards, guidelines, and frameworks to translate requirements into secure, scalable technical solutions. Responsibilities include contributing to security architecture and engineering, providing implementation guidance, technical analysis, and developing repeatable approaches for secure technology deployment. A key aspect is systems security engineering, integrating security and stakeholder protection throughout the system development life cycle. The ultimate goal is to enhance the cybersecurity posture, reduce organizational risk, and protect critical systems and information from evolving cyber threats.

Requirements

Minimum of 7 years of Information Security Experience of which at least 5 years are of risk and compliance experience at a large company or Government agency similar in size/scope to GSA, IRS, DoD or VA.
Expertise in risk management, compliance, audit, or related roles within an organization.
Expertise conducting internal and external audits to assess compliance with regulatory requirements and organizational policies.
Expertise developing and implementing risk management programs, including risk assessments, risk mitigation strategies, and continuous monitoring.
Expertise policy development, documentation, and enforcement.
Expertise handling and reporting compliance issues and coordinating with regulatory bodies.

Nice To Haves

An advanced degree (e.g. Master’s or PhD) in related field may substitute for up to 2 years of the required experience.
Bachelor’s degree in Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.
CASP+ (SecurityX), CCISO, CISA, CISM, CISSP, CISSP-ISSAP, CISSP-ISSEP, GCED, GCIH, GSLC, CCNP Security

Responsibilities

Perform and support comprehensive cybersecurity risk assessments for information systems, applications, platforms, technologies, processes, and enterprise initiatives.
Identify, analyze, evaluate, document, and monitor cybersecurity risks, vulnerabilities, control gaps, compliance deficiencies, and residual risks.
Develop and implement risk-management processes and programs, including risk identification, assessment, prioritization, mitigation, monitoring, and reporting.
Develop risk-mitigation strategies and corrective-action recommendations that are technically feasible, actionable, and aligned with Government risk tolerance and mission requirements.
Monitor identified risks throughout the system and program lifecycle and track the status and effectiveness of approved mitigation actions.
Support continuous monitoring activities to provide ongoing visibility into cybersecurity risk, compliance posture, control implementation, and outstanding remediation requirements.
Perform compliance assessments against applicable Federal cybersecurity requirements, VA policies, organizational standards, and approved security baselines.
Assess systems and cybersecurity activities for compliance with applicable NIST standards, OMB mandates, VA cybersecurity requirements, and other Federal security frameworks identified within the program.
Support risk-management activities aligned with NIST SP 800-53 and the NIST Cybersecurity Framework.
Evaluate compliance findings and provide clear recommendations supporting risk-based decisions regarding system accreditation and authorization.
Conduct and support internal and external cybersecurity audits, assessments, inspections, and reviews.
Coordinate with auditors, assessors, Government representatives, cybersecurity SMEs, system owners, engineers, and other stakeholders throughout audit and assessment activities.
Collect, review, organize, and validate supporting evidence requested during audits and assessments, including policies, procedures, system documentation, security reports, configuration information, logs, diagrams, and other technical artifacts.
Evaluate audit findings and develop remediation strategies, corrective actions, responsible-party assignments, and resolution timelines.
Track audit and compliance findings through resolution and verify that corrective actions adequately address identified deficiencies.
Support annual FISMA/FICAM audit activities and assist in developing actionable remediation recommendations for identified findings.
Develop and maintain Remediation Reports documenting audit findings, recommended corrective actions, responsible parties, mitigation strategies, and planned resolution timelines.
Develop and maintain Security Risk Analysis Reports that identify, evaluate, monitor, and communicate system-security risks.
Support development of Specialized Security Posture Reports evaluating the risks associated with new and emerging technologies such as Artificial Intelligence, Cloud Security, Post-Quantum Cryptography, medical devices, and Internet-of-Things technologies.
Assess changes in technologies, systems, regulatory requirements, and Government mandates to determine potential risk and compliance impacts.
Perform security architecture and compliance gap analyses to identify differences between existing implementations and required VA or Federal security requirements.
Document compliance gaps and recommend mitigation strategies consistent with Government security policies and enterprise risk tolerance.
Review security configuration and baseline-assessment findings to determine compliance status, deviations, risk implications, and required remediation actions.
Support requirements traceability between security controls, architectural requirements, system implementation, evidence, and Authority to Operate (ATO) activities.
Develop and maintain Requirements Traceability Matrices (RTMs) supporting accreditation, authorization, and compliance activities.
Support Federal Assessment and Authorization (A&A), Risk Management Framework (RMF), and ATO processes as applicable to assigned systems and initiatives.
Assist system owners and technical teams with interpreting cybersecurity requirements and determining appropriate evidence needed to demonstrate compliance.
Develop, review, maintain, and support enforcement of cybersecurity policies, procedures, standards, guidelines, and governance documentation.
Evaluate existing policies and procedures to identify gaps, inconsistencies, or changes needed to maintain alignment with evolving regulatory and organizational requirements.
Monitor relevant regulatory, policy, and security-requirement changes and assess their potential impact on VA systems and cybersecurity programs.
Identify and report compliance issues, material deviations, and areas of increased risk to appropriate program and Government stakeholders.
Prepare risk and compliance information suitable for technical teams, program managers, Government leadership, auditors, and other non-technical stakeholders.
Develop reports, briefings, dashboards, risk summaries, compliance status updates, and other materials communicating cybersecurity posture and remediation progress.
Maintain accurate and auditable records of risk decisions, findings, mitigation plans, compliance evidence, corrective actions, and closure status.
Coordinate with appropriate Government and regulatory stakeholders regarding compliance issues, assessments, findings, and remediation actions.
Support Government audit and inspection activities by ensuring requested information and documentation are provided accurately and in a timely manner.
Monitor adherence to approved security policies and requirements and escalate significant compliance issues when necessary.
Support third-party and supplier risk-management activities where assigned, including evaluation of vendor cybersecurity risk and compliance posture.
Assist in developing risk-assessment criteria, scoring methodologies, and risk thresholds for evaluating third-party or supplier cybersecurity risk.
Support cybersecurity supply-chain risk-management activities involving vendor assessments, third-party risk, and regulatory compliance.
Collaborate with cybersecurity architects, security engineers, DevSecOps personnel, program managers, system owners, technical SMEs, and other stakeholders to integrate risk and compliance requirements throughout the technology lifecycle.
Participate in technical reviews, governance forums, risk meetings, audit meetings, engineering working groups, and other activities requiring cybersecurity risk or compliance expertise.
Promote a risk-based approach to cybersecurity decision-making, balancing security requirements, mission needs, operational constraints, and remediation priorities.