GRC / Risk Management Lead

Role overview Lead an ongoing governance, risk, and compliance program supporting a large federal cybersecurity effort. The role manages risks from identification through remediation, administers the GRC platform, and turns assessment findings into practical actions while guiding a small team of analysts.

Responsibilities - Maintain the enterprise risk register, including risk identification, scoring, and mitigation tracking. - Manage the POA&M process from finding identification and remediation planning through closure validation. - Administer GRC platform workflows, control mappings, and evidence collection automation. - Lead supply chain and third-party risk assessments for prospective vendors, tools, and integrations. - Prepare risk dashboards and reporting for program and client leadership. - Support continuous authorization and security control assessments; maintain risk policies and procedures. - Coordinate remediation with technical and operational teams and mentor GRC analysts through quality reviews and development.

Requirements - At least 5 years of federal risk management experience, including direct application of the NIST Risk Management Framework. - Bachelor’s degree in IT, cybersecurity, business, or a related field; equivalent experience may substitute. - Strong knowledge of FISMA, NIST SP 800-53, NIST SP 800-37, and related federal compliance frameworks. - Experience administering a GRC platform, such as ServiceNow GRC, Xacta, RSA Archer, or a comparable tool. - Strong analytical and communication skills, including presenting risk information to leadership. - CRISC or CISM certification.

Nice to have - CISSP or CGRC (formerly CAP) certification.

Benefits and work setup - The source gives a base pay range of $109,500–$224,200 for a specified set of US states and the District of Columbia. Pay varies by location, skills, and experience.