Note: The job is a remote job and is open to candidates in USA. Peraton is a next-generation national security company and mission capability integrator providing transformative enterprise IT solutions to government agencies and the U.S. armed forces. Peraton Labs is seeking a Senior GRC / Third-Party Risk / Data Protection Analyst to lead governance, risk, and compliance activities, third-party security risk management, data protection, and insider threat program support for a California health benefit exchange and eligibility system.
Responsibilities
- Own policy and control documentation. Author and maintain security policies, procedures, standards, plans, and control documentation for the environment
- Test controls and close POA&Ms. Perform control testing and gap analysis against NIST SP 800-53 Rev. 5, document deficiencies, and manage POA&Ms through remediation and verified closure
- Keep the program audit-ready. Maintain the control evidence library and GRC platform records, control mappings, and compliance reporting; support the annual independent assessment as the operational-side evidence provider, without acting as an assessor
- Run third-party security risk management. Conduct vendor security due diligence and assessments, contract and control reviews, continuous monitoring, and risk reporting
- Lead data protection. Discover and catalog confidential data, define and apply the data classification scheme, and implement protective controls including DLP, encryption, and access controls
- Support the insider threat program. Contribute to insider threat use cases, monitoring, and escalation procedures in coordination with privacy, HR, and legal stakeholders
- Carry the regulated-data obligations. Support IRS Publication 1075 and ARC-AMPE compliance activities and the privacy obligations of the contract's Privacy Addendum; participate in the on-call incident response rotation
Skills
- Bachelor's degree in information systems, cybersecurity, or business with a security concentration. In lieu of a degree, an additional 4 years of relevant experience will be considered
- 8+ years of experience in security governance, risk, and compliance, third-party risk management, or data protection
- Active CISA or CGRC certification
- Demonstrated experience performing control assessment and gap analysis against NIST SP 800-53 Rev. 5, and managing the POA&M lifecycle from deficiency identification through closure
- Demonstrated third-party and vendor security risk management experience, including questionnaire-based assessment frameworks such as SIG or CAIQ, contract and control review, and continuous monitoring
- Hands-on experience with data classification and data-flow mapping, and with an enterprise DLP platform such as Microsoft Purview, Netskope, or Forcepoint
- Precise compliance writing ability - policies, control narratives, and deficiency write-ups that withstand external review - and working knowledge of an enterprise GRC platform
- US Citizenship and the abillity to pass a California criminal background clearance (Gov. Code • 1043 / 10 CCR • 6456) before starting work or accessing any confidential information, PII, PHI, federal tax information, or financial information
- CIPP/US certification. CRISC, CIPT, or CISM are also valued
- Experience with ARC-AMPE security and privacy requirements
- Experience with IRS Publication 1075 and FTI safeguarding, including participation in a Safeguard Review
- Working knowledge of HIPAA/HITECH and the California Consumer Privacy Act
- Experience with CMS requirements and Authority to Connect support, including Security Assessment Workbooks (SAWs), security assessment reports, and control evidence packages
- Experience in California state government compliance environments
- Experience with health benefit exchange or Medicaid eligibility systems
- Experience with encryption and key management concepts and with insider threat program design
Benefits
- Medical insurance
- Dental insurance
- Vision insurance
- Life insurance
- Health savings account (HSA)
- Short-term disability
- Long-term disability
- Employee assistance program (EAP)
- Parental leave
- 401(k)
- Paid time off (PTO) for vacation
- Company-paid holidays
- Employees may be eligible for overtime
- Employees may be eligible for shift differential
- Employees may be eligible for a discretionary bonus
Company Overview