Governance, Risk and Compliance Technical Lead

Requisition #: 647

Job Title: Governance, Risk and Compliance Technical Lead

Location: 1155 21st St NW Washington DC, District of Columbia20036 - HYBRID on site once a week (Wednesdays)

Clearance Level: Active Public Trust

CISSP, CISA, CRISC, CISM or other industry-level cyber certification required.

The Governance, Risk and Compliance Technical (GRC) Lead will support a government agency in the achievement of strategic goals and objectives related to the ongoing execution and maturity of its cybersecurity and assessment and authorization (A&A) programs.

The ideal candidate is a detail-oriented, self-starter who thrives in fast-paced environments, enjoys working in a dynamic environment, and has a passion for helping customers mature, standardize, and measure their A&A program. In this role, the GRC Lead will focus on standardizing the A&A program for the customer. The ideal candidate will be primarily responsible for building standard operating procedures (SOPs), playbooks, runbooks, or handbooks as needed that instruct Information System Security Officers and Security Assessors on how to implement the Risk Management Framework (RMF) at CFTC. Additionally, the ideal candidate will create similar documents to describe how the ISSOs and SCAs perform day-to-day tasks at CFTC. To be successful in this role, the GRC Lead will work closely with the A&A Federal Task Manager and the Deputy Chief Information Security Officer to reconcile differences in approaches, verify/validate the approach, gain customer buy-in, and track and report progress to the customer regularly.

Serve as the Federal GRC Program Manager's primary point of contact for the RMF and ISSO handbook development.

Support the agency's risk management process by maintaining visibility and awareness of changes to the cyber threat landscape that impact the Agency and ensure efforts to address risk are executed efficiently and on schedule.

Interface broadly with internal branch customers as well as external branch stakeholders to support achievement of the program's strategic goals and objectives and mature its A&A capabilities and services.

Work with a team of ISSOs and SCAs to understand the current people, processes, and technologies in place at CFTC to accomplish RMF including FedRAMP.

Oversee, in coordination with the GRC Program Manager, execution of A&A and ongoing authorization activities and provide guidance and technical direction to the team as required. Serve as a secondary interface on status of packages to cybersecurity leadership.

Collaborate with the Security Engineering and Architecture team on initiatives, projects, and activities (e.g., cloud architecture, security engineering, vulnerability management, cyber dashboard development) related to how the customer uses these resources to complete RMF requirements.

Support the GRC PM in ensuring a coordinated and collaborated approach on whole-of-program efforts in support of RMF/CSF maturity.

Support the development and enhancement of security dashboards using a GRC application (e.g., CSAM) and/or customer tool(s) to provide role-based views (i.e., information/data) to agency executives, managers, system security officers, and key stakeholders, as needed.

Provide technical guidance and best practices to the team and customers to ensure that the agency achieves maximum value from its IT investments.

This is a non-supervisory position.

CISSP, CISA, CRISC, CISM or other industry-level cyber certification required.

Bachelor's Degree required (Information Technology, Cyber Security, Computer Science, Computer Engineering, or Electrical Engineering).

7+ years of experience in cybersecurity, of those,at least 3+ years in a GRC role or similar (Technology/IT Audit, InternalAudit, IT Consulting, etc.) leading small teams (5-15 staff) of Information System Security Officers (ISSOs) and Security Control Assessors (SCAs).

Demonstrated experience with establishing, implementing, and maintaining the A&A lifecycle using the NIST RMF.

Strong technical writing skills to develop clear and concise documentation, such as SOPs, handbooks, and playbooks.

In-depth knowledge in the field of risk management and compliance to efficientlywork on and apply the RMF including a deep understanding of the NIST SP 800-53, NIST SP 800-171, NIST SP 800-137, NIST SP 1800 series, FIPS 199, FIPS 200, NIST SP 800-60 volume 1 and 2, etc.

Demonstrated experience with the development and update of policies to align with OMB, DHS, NIST, CNSS, ICD, Congressional and other cybersecurity mandates, and directives.

Experience ensuring controls meet legal, regulatory, privacy, policy, standards and security requirements, and proficiency in conducting risk assessments and developing mitigation strategies.

Demonstrated knowledge in the field of risk management, compliance, and cloud to efficientlywork on and apply frameworks including ISO, NIST CSF, NIST 800-53, NIST 800-171, NIST 800-137, NIST 1800 series, FEDRAMP, etc.

Strong verbal, written, and presentation skills.

Hands-on experience performing using CSAM as an ISSO or SCA required.

Experience tracking and reporting the status of projects using tools like Microsoft Planner, Excel, Microsoft Project, and others.

Experience presenting developing and presenting the status of project milestones, blockers, and developing timelines for projects.

Experience working with multiple stakeholders across various functions with varying degrees of technical and A&A experience.

Experience in managing complex projects, including planning, execution, and monitoring.

Proven ability to lead and mentor a team, fostering a collaborative and productive work environment.

Strong interpersonal skills to effectively communicate with stakeholders at all levels, including executives and technical staff.

Ability to identify issues, analyze problems, and develop effective solutions independently.

Ability to adapt to changing priorities and work effectively in a fast-paced environment.

Experience working in cross-functional teams and coordinating efforts across different departments.

Commitment to continuous learning and staying updated with the latest trends and best practices in cybersecurity and risk management.

Happy - Be Infectious.

Helpful - Be Supportive.

Honest - Be Trustworthy.

Humble - Be Grounded.

Hungry - Be Eager.

Hustle - Be Driven.

The contractor will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor's legal duty to furnish information. 41 CFR 60-1.35 (c)