GRC Analyst

C2 Labs partners with clients on their IT transformation journey via data-driven IT strategic planning, application rationalization and redevelopment, and innovative research and development of new industry standards and technologies. We provide specialized products and services that allow clients to innovate with speed and scale while maintaining a robust security posture.

This is a two-year contract position. Must live in the Knoxville, Tennessee metro area, be a US Citizen, and be capable of passing a Public Trust background investigation.

About the role

As a Governance Risk and Compliance (GRC) Analyst at C2 Labs, you will work with a team of security analysts and engineers to implement regulatory frameworks such as FISMA, FedRAMP, and StateRAMP. You will leverage GRC tools to develop security authorization package documentation—including the System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Report (SAR), and Plan of Actions & Milestones (POA&M)—in both human-readable and machine-readable formats. Your primary responsibility will be ensuring the timely development of these packages in accordance with C2 Labs quality standards.

Responsibilities

• Categorize systems in accordance with Federal Information Processing Standards (FIPS) 199 and NIST Special Publication (SP) 800-60.
• Select and tailor security controls by applying scoping guidance in accordance with NIST SP 800-53 and FedRAMP-specific guidance.
• Document the implementation characteristics for security controls with enough detail to permit testing by an independent assessor or Third Party Assessment Organization (3PAO).
• Develop, review, and update security authorization package documentation, including the SSP, SAP, SAR, and POA&M.
• Develop, review, and update supporting documentation, including the Contingency Plan (CP), Incident Response Plan (IRP), and Configuration Management Plan (CMP).
• Conduct Security Impact Assessments (SIAs) on changes to information systems.
• Create the Control Implementation Summary (CIS)/Customer Responsibility Matrix (CRM) workbook outlining Cloud Service Provider (CSP) and customer responsibilities.
• Develop, review, and update policies and procedures to support the implementation of the NIST 800-53 control families.
• Leverage next-generation GRC tools to automate the creation of the SSP.
• Review current security assessment and authorization processes and provide recommendations for improvement.
• Develop Risk Assessment Reports (RAR).
• Provide guidance on NIST 800-53, FedRAMP, and StateRAMP control requirements.
• Develop and deliver training to educate stakeholders on tasks and activities associated with the Risk Management Framework (RMF).
• Prepare monthly continuous monitoring deliverables (e.g., vulnerability scans, POA&Ms, and asset inventory) for submission to the FedRAMP PMO.

Requirements

• Minimum 1–3 years of experience in IT consulting specializing in Governance, Risk, and Compliance using the RMF.
• CISSP, CISM, or CAP certification is preferred but not required.
• In-depth understanding of the FedRAMP authorization process and associated templates and deliverables.
• Experience creating security authorization package documentation (e.g., SSP, SAP, SAR, POA&M) and managing system authorization artifacts for a FedRAMP-authorized cloud environment.
• Strong technical writing skills and the ability to work independently under general direction.
• Ability to interpret and provide consulting expertise on FedRAMP security requirements.
• Extensive knowledge in reviewing, analyzing, and documenting secure implementation of logical controls, physical controls, environmental controls, personnel security, and incident handling.
• US Citizenship and ability to pass a Public Trust background investigation.

Skills

• Working knowledge of:
  • NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations
  • FedRAMP Security Controls Baselines (Low, Moderate, High, and Li-SaaS)
  • StateRAMP Security Control Baselines (Low Impact Ready, Low Impact Authorized, Moderate Impact Ready, Moderate Impact Authorized)
  • NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems
• Excellent communication and interpersonal skills, with the ability to build rapport and trust with clients.
• Knowledge of the cybersecurity industry, including regulatory frameworks such as NIST RMF, FedRAMP, DoD Impact Levels (2–6), and StateRAMP.

Practical AI Application

• Applies AI tools to streamline workflows, enhance decision-making, and improve outcomes.
• Understands the strengths and limitations of AI systems and exercises sound judgment in their use.
• Continuously explores new AI capabilities and integrates them into day-to-day work where appropriate.
• Uses AI in alignment with company and customer-specific policies, data privacy standards, and ethical guidelines.
• Exercises discretion when using AI with sensitive or proprietary information.
• Demonstrates awareness of bias, accuracy, and risk considerations when leveraging AI tools.