Senior Cyber GRC Analyst

SAIC•El Paso, TX

6d•Remote

About The Position

SAIC is seeking a remote Senior Cyber GRC Analyst to provide Security Operations Services for a major state and local government customer in Texas. No program work may be performed outside the United States. Reporting to the Technical Director, this position is part of a team providing security planning, management, and oversight for data center and cloud services. The role focuses on cyber vulnerability and risk management, threat intelligence, security standards and policy, and related tasks and recurring deliverables. The analyst uses standards-based guidance, including the NIST Risk Management Framework and NIST SP 800-53 Revision 4, to assess and manage risk, coordinate security controls and audits, oversee compliance documentation, and support risk response across SAIC, its customers, suppliers, and service providers. The role also produces reports and executive briefings, coordinates business continuity and disaster recovery activities, and leads maintenance of policies, procedures, and job aids.

Requirements

Bachelor’s degree in a related discipline and five years of related experience, or a master’s degree and three years of experience in a related discipline such as information security.
Three to five years of experience with cyber risk management, including the NIST RMF and SP 800-53 Revision 4.
Three to five years of experience with cyber vulnerability and/or risk management.
Three to five years of experience providing and coordinating cybersecurity assessments and audits.
Cybersecurity certification; examples include CompTIA Security+, CEH, CISA, CISM, and GSLC.
Experience developing and documenting cybersecurity policies and standards.
Cybersecurity experience in data center and cloud environments.
Ability to create reports and visualizations to support risk and compliance activities.
Excellent oral and written communication skills.

Nice To Haves

CISSP or CRISC certification is preferred.
Experience with vulnerability management and compliance scanning tools such as Tenable or Qualys.
Experience with ITIL; ITIL certification.
Experience with ITSM/reporting tools such as ServiceNow.

Responsibilities

Perform risk analysis using the NIST Risk Management Framework and other standards-based guidance, including identifying risks, recommending mitigations, and tracking risks throughout their lifecycle.
Perform threat modeling and assessment.
Analyze vulnerability data from scanning tools, cyber intelligence, and other sources to determine validity, severity, and impact to SAIC customers.
Coordinate internal and external audit activities, including external SOC II Type 2 audits.
Use NIST SP 800-53 Revision 4 and other references to design and coordinate implementation of cybersecurity controls with technical teams.
Coordinate and oversee development of system security plans and compliance with standards and policies.
Work with peer supplier organizations to assess risks associated with their systems and technologies and coordinate risk management and response activities.
Maintain POAMs and supervise others' completion of assigned tasks and activities.
Perform baseline assessments of cybersecurity compliance against documented standards and requirements.
Help ensure SAIC and in-scope systems are patched according to approved schedules and requirements.
Provide input and assessment of new risks and recommend actions.
Coordinate annual cybersecurity assessments across multiple vendors and service providers and produce a consolidated assessment report.
Provide reports, communications, and stakeholder and management engagement.
Provide senior management and executive briefings, summaries, and reports on activities, assessments, and cybersecurity posture.
Coordinate business continuity and disaster recovery activities.
Lead maintenance of policies, procedures, and related job-aid documentation.