Corporate Governance, Risk, and Compliance Analyst, Onebrief

• U.S. Citizen
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field
• 8+ years in cybersecurity compliance
• Hands-on expertise with RMF and at least one of CMMC 2.0 or SOC 2
• One or more of the following certifications: CISSP, CISM, CISSO, CPTE, CySA+, FITSP-A, GCSA, CISA, ISSEP, GSLC, or GSNA
• Experience with GRC platforms, including automated evidence collection and testing (eMASS experience a plus)

Desirable

• Own RMF authorizations across Department of War components and FedRAMP High, alongside CMMC 2.0 and SOC 2 compliance for corporate systems
• Maintain authorization and audit evidence, including SSPs, SARs, POA&Ms, STIGs, and control mappings
• Partner with Engineering, Product, and Security to embed compliance requirements into system design and CI/CD workflows, not bolt them on afterward
• Coordinate internal assessments and external audit readiness across all applicable frameworks
• Track regulatory and contractual changes and advise leadership on what they mean for Onebrief
• Run risk assessments and vendor/supply chain risk reviews across both federal and corporate environments
• A successful Governance, Risk, and Compliance Analyst will:
• Keep authorization packages current across every framework instead of reconstructing them under deadline pressure
• Reduce manual audit prep by automating control testing and evidence collection
• Close open POA&M and corrective action items on a predictable cadence
• Become the go-to person engineers check with before shipping changes that touch compliance boundaries, federal or corporate
• Tools, Systems & Technologies
• EMASS, GRC platforms, NIST RMF documentation (SSPs, SARs, POA&Ms, STIGs), CMMC 2.0 and SOC 2 control frameworks