Governance, Risk And Compliance Technical Lead

At Agile Defense we know that action defines the outcome and new challenges require new solutions. That's why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next. Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility—leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation's vital interests. Requisition #: 647
Job Title: Governance, Risk and Compliance Technical Lead
Location: 1155 21st St NW Washington DC, District of Columbia20036 - HYBRID on site once a week (Wednesdays)
Clearance Level: Active Public Trust
Required Certification(s):  CISSP, CISA, CRISC, CISM or other industry-level cyber certification required.
SUMMARY: The Governance, Risk and Compliance Technical (GRC) Lead will support a government agency in the achievement of strategic goals and objectives related to the ongoing execution and maturity of its cybersecurity and assessment and authorization (A&A) programs.
The ideal candidate is a detail-oriented, self-starter who thrives in fast-paced environments, enjoys working in a dynamic environment, and has a passion for helping customers mature, standardize, and measure their A&A program. In this role, the GRC Lead will focus on standardizing the A&A program for the customer. The ideal candidate will be primarily responsible for building standard operating procedures (SOPs), playbooks, runbooks, or handbooks as needed that instruct Information System Security Officers and Security Assessors on how to implement the Risk Management Framework (RMF) at CFTC. Additionally, the ideal candidate will create similar documents to describe how the ISSOs and SCAs perform day-to-day tasks at CFTC. To be successful in this role, the GRC Lead will work closely with the A&A Federal Task Manager and the Deputy Chief Information Security Officer to reconcile differences in approaches, verify/validate the approach, gain customer buy-in, and track and report progress to the customer regularly.
JOB DUTIES AND RESPONSIBILITIES: Serve as the Federal GRC Program Manager's primary point of contact for the RMF and ISSO handbook development.
Support the agency's risk management process by maintaining visibility and awareness of changes to the cyber threat landscape that impact the Agency and ensure efforts to address risk are executed efficiently and on schedule.
Interface broadly with internal branch customers as well as external branch stakeholders to support achievement of the program's strategic goals and objectives and mature its A&A capabilities and services.
Work with a team of ISSOs and SCAs to understand the current people, processes, and technologies in place at CFTC to accomplish RMF including FedRAMP.
Oversee, in coordination with the GRC Program Manager, execution of A&A and ongoing authorization activities and provide guidance and technical direction to the team as required. Serve as a secondary interface on status of packages to cybersecurity leadership.
Collaborate with the Security Engineering and Architecture team on initiatives, projects, and activities (e.g., cloud architecture, security engineering, vulnerability management, cyber dashboard development) related to how the customer uses these resources to complete RMF requirements.
Support the GRC PM in ensuring a coordinated and collaborated approach on whole-of-program efforts in support of RMF/CSF maturity.
Support the development and enhancement of security dashboards using a GRC application (e.g., CSAM) and/or customer tool(s) to provide role-based views (i.e., information/data) to agency executives, managers, system security officers, and key stakeholders, as needed.
Provide technical guidance and best practices to the team and customers to ensure that the agency achieves maximum value from its IT investments.
SUPERVISORY DUTIES: This is a non-supervisory position.
QUALIFICATIONS: Required Certifications: CISSP, CISA, CRISC, CISM or other industry-level cyber certification required.
Education, Background, and Years of Experience: Bachelor's Degree required (Information Technology, Cyber Security, Computer Science, Computer Engineering, or Electrical Engineering).
7+ years of experience in cybersecurity, of those,at least 3+ years in a GRC role or similar (Technology/IT Audit, InternalAudit, IT Consulting, etc.) leading small teams (5-15 staff) of Information System Security Officers (ISSOs) and Security Control Assessors (SCAs).
ADDITIONAL SKILLS & QUALIFICATIONS: Required Skills: Demonstrated experience with establishing, implementing, and maintaining the A&A lifecycle using the NIST RMF.
Strong technical writing skills to develop clear and concise documentation, such as SOPs, handbooks, and playbooks.
In-depth knowledge in the field of risk management and compliance to efficientlywork on and apply the RMF including a deep understanding of the NIST SP 800-53, NIST SP 800-171, NIST SP 800-137, NIST SP 1800 series, FIPS 199, FIPS 200, NIST SP 800-60 volume 1 and 2, etc.
Demonstrated experience with the development and update of policies to align with OMB, DHS, NIST, CNSS, ICD, Congressional and other cybersecurity mandates, and directives.
Experience ensuring controls meet legal, regulatory, privacy, policy, standards and security requirements, and proficiency in conducting risk assessments and developing mitigation strategies.
Demonstrated knowledge in the field of risk management, compliance, and cloud to efficientlywork on and apply frameworks including ISO, NIST CSF, NIST 800-53, NIST 800-171, NIST 800-137, NIST 1800 series, FEDRAMP, etc.
Strong verbal, written, and presentation skills.
Hands-on experience performing using CSAM as an ISSO or SCA required.
Preferred Skills Experience tracking and reporting the status of projects using tools like Microsoft Planner, Excel, Microsoft Project, and others.
Experience presenting developing and presenting the status of project milestones, blockers, and developing timelines for projects.
Experience working with multiple stakeholders across various functions with varying degrees of technical and A&A experience.
Experience in managing complex projects, including planning, execution, and monitoring.
Proven ability to lead and mentor a team, fostering a collaborative and productive work environment.
Strong interpersonal skills to effectively communicate with stakeholders at all levels, including executives and technical staff.
Ability to identify issues, analyze problems, and develop effective solutions independently.
Ability to adapt to changing priorities and work effectively in a fast-paced environment.
Experience working in cross-functional teams and coordinating efforts across different departments.
Commitment to continuous learning and staying updated with the latest trends and best practices in cybersecurity and risk management.
\n
\nEmployees of Agile Defense are our number one priority, and the importance we place on our culture here is fundamental. Our culture is alive and evolving, but it always stays true to its roots. Here, you are valued as a family member, and we believe that we can accomplish great things together. Agile Defense has been highly successful in the past few years due to our employees and the culture we create together. What makes us Agile? We call it the 6Hs, the values that define our culture and guide everything we do. Together, these values infuse vibrancy, integrity, and a tireless work ethic into advancing the most important national security and critical civilian missions. It's how we show up every day. It's who we are. Happy - Be Infectious. Happiness multiplies and creates a positive and connected environment where motivation and satisfaction have an outsized effect on everything we do. Helpful - Be Supportive. Being helpful is the foundation of teamwork, resulting in a supportive atmosphere where collaboration flourishes, and collective success is celebrated. Honest - Be Trustworthy. Honesty serves as our compass, ensuring transparent communication and ethical conduct, essential to who we are and the complex domains we support. Humble - Be Grounded. Success is not achieved alone, humility ensures a culture of mutual respect, encouraging open communication, and a willingness to learn from one another and take on any task. Hungry - Be Eager. Our hunger for excellence drives an insatiable appetite for innovation and continuous improvement, propelling us forward in the face of new and unprecedented challenges. Hustle - Be Driven. Hustle is reflected in our relentless work ethic, where we are each committed to going above and beyond to advance the mission and achieve success. Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities The contractor will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor's legal duty to furnish information. 41 CFR 60-1.35(c)