Risk and Compliance Analyst United States - Remote

9th Way Insignia is a service-disabled, veteran-owned small business bringing transformative technology to our government customers so they can achieve their missions. Our specialties include cybersecurity, cloud modernization, software development, data analytics, enterprise architecture, enterprise IT, analytics, process automation, and artificial intelligence. Learn more about 9th Way Insignia at Team (Project) Introduction We are recruiting for a range of cybersecurity opportunities supporting federal customers , focused on strengthening enterprise security architecture, systems engineering, and the secure implementation of technologies across the environment. The work involves applying established cybersecurity standards, guidelines, and frameworks to help translate organizational and business requirements into secure, scalable technical solutions. Team members may contribute to security architecture and engineering efforts, implementation guidance, technical analysis, and the development of repeatable approaches that support the consistent deployment and operation of secure technologies across complex enterprise environments. Systems security engineering is an important component of this work, with an emphasis on incorporating security and stakeholder protection requirements throughout the system development life cycle, from concept and design through development, production, sustainment, and decommissioning. The team will apply established systems engineering and cybersecurity principles to help protect systems, applications, data, and supporting technologies. Ultimately, this work supports the broader mission to strengthen its cybersecurity posture, reduce organizational risk, and protect critical systems and information from evolving cyber threats, including external adversaries and insider threats. 9 th Way Insignia is looking for an Engineer, 3, Risk and Compliance Analyst to join this team. Professional Level Information: An Engineer, 3 typically plans and directs research or development work on complex projects, along with engaging various parties in design and development. Costs and recommendations of new components may also involve part of the job scope. Performs multiple engineering-related tasks in various assignments within the project and firm. An Engineer, 3 oversees the design, development, implementation, and analysis of technical products and systems. An Engineer, 3 has broad knowledge of engineering procedures and assists in the resolution of complex problems. An Engineer, 3 has strong technical skills and background, a knack for learning new technologies, and a blend of good problem-solving and innovation needed to resolve a wide variety of technical production challenges. Responsibilities: Perform and support comprehensive cybersecurity risk assessments for information systems, applications, platforms, technologies, processes, and enterprise initiatives. Identify, analyze, evaluate, document, and monitor cybersecurity risks, vulnerabilities, control gaps, compliance deficiencies, and residual risks. Develop and implement risk-management processes and programs, including risk identification, assessment, prioritization, mitigation, monitoring, and reporting. Develop risk-mitigation strategies and corrective-action recommendations that are technically feasible, actionable, and aligned with Government risk tolerance and mission requirements. Monitor identified risks throughout the system and program lifecycle and track the status and effectiveness of approved mitigation actions. Support continuous monitoring activities to provide ongoing visibility into cybersecurity risk, compliance posture, control implementation, and outstanding remediation requirements. Perform compliance assessments against applicable Federal cybersecurity requirements, VA policies, organizational standards, and approved security baselines. Assess systems and cybersecurity activities for compliance with applicable NIST standards, OMB mandates, VA cybersecurity requirements, and other Federal security frameworks identified within the program. Support risk-management activities aligned with NIST SP 800-53 and the NIST Cybersecurity Framework. Evaluate compliance findings and provide clear recommendations supporting risk-based decisions regarding system accreditation and authorization. Conduct and support internal and external cybersecurity audits, assessments, inspections, and reviews. Coordinate with auditors, assessors, Government representatives, cybersecurity SMEs, system owners, engineers, and other stakeholders throughout audit and assessment activities. Collect, review, organize, and validate supporting evidence requested during audits and assessments, including policies, procedures, system documentation, security reports, configuration information, logs, diagrams, and other technical artifacts. Evaluate audit findings and develop remediation strategies, corrective actions, responsible-party assignments, and resolution timelines. Track audit and compliance findings through resolution and verify that corrective actions adequately address identified deficiencies. Support annual FISMA/FICAM audit activities and assist in developing actionable remediation recommendations for identified findings. Develop and maintain Remediation Reports documenting audit findings, recommended corrective actions, responsible parties, mitigation strategies, and planned resolution timelines. Develop and maintain Security Risk Analysis Reports that identify, evaluate, monitor, and communicate system-security risks. Support development of Specialized Security Posture Reports evaluating the risks associated with new and emerging technologies such as Artificial Intelligence, Cloud Security, Post-Quantum Cryptography, medical devices, and Internet-of-Things technologies. Assess changes in technologies, systems, regulatory requirements, and Government mandates to determine potential risk and compliance impacts. Perform security architecture and compliance gap analyses to identify differences between existing implementations and required VA or Federal security requirements. Document compliance gaps and recommend mitigation strategies consistent with Government security policies and enterprise risk tolerance. Review security configuration and baseline-assessment findings to determine compliance status, deviations, risk implications, and required remediation actions. Support requirements traceability between security controls, architectural requirements, system implementation, evidence, and Authority to Operate (ATO) activities. Develop and maintain Requirements Traceability Matrices (RTMs) supporting accreditation, authorization, and compliance activities. Support Federal Assessment and Authorization (A&A), Risk Management Framework (RMF), and ATO processes as applicable to assigned systems and initiatives. Assist system owners and technical teams with interpreting cybersecurity requirements and determining appropriate evidence needed to demonstrate compliance. Develop, review, maintain, and support enforcement of cybersecurity policies, procedures, standards, guidelines, and governance documentation. Evaluate existing policies and procedures to identify gaps, inconsistencies, or changes needed to maintain alignment with evolving regulatory and organizational requirements. Monitor relevant regulatory, policy, and security-requirement changes and assess their potential impact on VA systems and cybersecurity programs. Identify and report compliance issues, material deviations, and areas of increased risk to appropriate program and Government stakeholders. Prepare risk and compliance information suitable for technical teams, program managers, Government leadership, auditors, and other non-technical stakeholders. Develop reports, briefings, dashboards, risk summaries, compliance status updates, and other materials communicating cybersecurity posture and remediation progress. Maintain accurate and auditable records of risk decisions, findings, mitigation plans, compliance evidence, corrective actions, and closure status. Coordinate with appropriate Government and regulatory stakeholders regarding compliance issues, assessments, findings, and remediation actions. Support Government audit and inspection activities by ensuring requested information and documentation are provided accurately and in a timely manner. Monitor adherence to approved security policies and requirements and escap significant compliance issues when necessary. Support third-party and supplier risk-management activities where assigned, including evaluation of vendor cybersecurity risk and compliance posture. Assist in developing risk-assessment criteria, scoring methodologies, and risk thresholds for evaluating third-party or supplier cybersecurity risk. Support cybersecurity supply-chain risk-management activities involving vendor assessments, third-party risk, and regulatory compliance. Collaborate with cybersecurity architects, security engineers, DevSecOps personnel, program managers, system owners, technical SMEs, and other stakeholders to integrate risk and compliance requirements throughout the technology lifecycle. Participate in technical reviews, governance forums, risk meetings, audit meetings, engineering working groups, and other activities requiring cybersecurity risk or compliance expertise. Promote a risk-based approach to cybersecurity decision-making, balancing security requirements, mission needs, operational constraints, and remediation priorities. May require occasional on-site visits Requirements: Minimum of7years of Information Security Experience of which at least 5 yearsare ofrisk and compliance experienceat a largecompany orGovernment agency similar in size/scope to GSA, IRS,DoDor VA. An advanced degree (e.g.Master’sor PhD) in related field may substitute for up to 2 years of the required experience. Expertise inrisk management, compliance, audit, or related roles within an organization. Expertiseconducting internal and external audits to assess compliance with regulatory requirements and organizational policies. Expertise developing and implementing risk management programs, including risk assessments, risk mitigation strategies, and continuous monitoring. Expertise policy development, documentation, and enforcement. Expertise handling and reporting compliance issues and coordinating with regulatory bodies. Up to two travel times per year Bachelor’s degree inBusiness Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields. CASP+ (SecurityX), CCISO, CISA, CISM, CISSP, CISSP-ISSAP, CISSP-ISSEP, GCED, GCIH, GSLC, CCNP Security Salary Range

$98,135.18 - $115,000 USD

9thWay Insignia’s range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law. Clearance/Background Investigation Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information. Benefits Eligible employees will have access to our comprehensive benefits package which includes Medical, Dental, Vision, Voluntary Life Insurance, 401(k), Basic Life A&D, STD, LTD, PTO, Telehealth, paid holidays, FSA, HSA. Additional resources include our Employee Assistance Program (EAP) and Traveling Assistance. Legal We’re an equal employment opportunity employer that empowers our people to fearlessly drive change - no matter their race, color, religion, sex (including pregnancy, childbirth, lactation, or related medical conditions), national origin, age, marital status, sexual orientation, gender identity, disability, veteran status, military or uniformed service member status, genetic information, or any other status protected by applicable federal, state, or local law. Create a Job Alert Interested in building your career at 9th Way Insignia? Get future opportunities sent straight to your email. Voluntary Self-Identification For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file. As set forth in 9th Way Insignia’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law. If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows: A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability. A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service. An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense. An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985. Select... Voluntary Self-Identification of Disability Form CC-305 Page 1 of 1 OMB Control Number 1250-0005 Expires 07/31/2029 Why are you being asked to complete this form? We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure... How do you know if you have a disability? Alcohol or other substance use disorder (not currently using drugs illegally) Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS Blind or low vision Cancer (past or present) Cardiovascular or heart disease Celiac disease Cerebral palsy Deaf or serious difficulty hearing Diabetes Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders Epilepsy or other seizure disorder Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome Intellectual or developmental disability Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD Missing limbs or partially missing limbs Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS) Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities Partial or complete paralysis (any cause) Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema Short stature (dwarfism) Traumatic brain injury PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a #J-18808-Ljbffr 9th Way Insignia