GRC Analyst - Public Sector

Runs the day-to-day governance, risk and compliance work for Socure's public sector business, reporting to the Director of GRC – Public Sector and based at the Washington, DC hub on a hybrid basis. The analyst keeps the FedRAMP and GovRAMP programme audit-ready.

The work covers 3PAO assessments and auditor requests, maintaining NIST SP 800-53 rev 5 controls, the SSP and authorisation packages, running continuous monitoring and the vulnerability lifecycle with tools such as Wiz and Burp Suite, coordinating access reviews, IR exercises and contingency tests, and moving evidence toward automated, machine-readable forms such as OSCAL. Over time the role adds persuasive customer-facing compliance and RFP content. Socure wants four or more years of hands-on security or compliance work including personal FedRAMP or GovRAMP continuous monitoring; candidates must be US Persons able to obtain an OPM NACI clearance.