The Opportunity :

Enterprise Cybersecurity (ECS) Governance, Risk and Compliance (GRC) play a pivotal role in safeguarding the organization's sensitive information and ensuring compliance with stringent cybersecurity regulation and guidance. The GRC team is responsible for assessing and managing compliance and regulatory requirements in partnership with key stakeholders. ECS is seeking a definitive Subject Matter Expert in Cybersecurity Maturity Model Certification (CMMC) Levels 2 and 3 and National Institute of Standards and Technology (NIST) frameworks to lead compliance architecture and assessment within our Extended Enterprise Environment (EEE). Reporting through GRC leadership to the Cybers Information Security Officer (CISO), this executive-level contributor will audit controls and actively engineer compliance.

This role is responsible for reviewing and assessing technical and environmental details and providing a hands-on approach to ensure security compliance and regulatory requirements are achieved. This role collaborates with cross-functional teams across the Booz Allen enterprise and client teams. Due to the nature of work performed within this facility, U.S. citizenship is required.

Join us. The world can’t wait.

You Have:

• 10+ years of experience in cybersecurity or GRC

• E xperience in cybersecurity roles such as Security Control Assessor (SCA), Validator, Information System Security Officer (ISSO), Information System Security Engineer (ISSE), or Information Systems Security Manager (ISSM)

• Experience with security control s alignment , and assessment against CMMC, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, NIST SP 800-171 rev. 2 and rev. 3 , Risk Management Framework (RMF), Federal Information Processing Standards (FIPS) 199, FIPS 200 and associated SPs , and Federal Risk and Authorization Management Program (FedRAMP)

• Experience t ranslat ing CMMC Level 3, NIST SP 800-171, and NIST SP 800-172 requirements into actionable engineering directives, l eading the validation of evidence requirements for Level 2 and Level 3 assessments and meticulously analyz e environment records, and identifying compliance gaps in complex systems, and driving remediation

• Experience manag ing the full risk lifecycle, from identification to implementation of risk reducing strategies and final closure, using both qualitative and quantitative frameworks

• Experience performing in-depth continuous monitoring and assessment of cybersecurity controls, evidence , and scan results to evaluate effectiveness and ensure continuous compliance

• Experience partnering with IT, operations, and delivery teams to provide expert guidance, drive GRC initiatives, and foster a culture of awareness and knowledge for security compliance

• Experience leveraging GRC automation platforms, such as eMASS , ServiceNow, RSA Archer, CSAM, or Telos Xacta

• Ability to develop, maintain , and communicate metrics and reports regarding compliance and vulnerability management

• HS diploma or GED
  

Nice If You Have:

• A bility to work independently and manage resources effectively to drive successful outcomes

• Ability to negotiate, influence stakeholders, and drive issues to closure

• Ability to engage senior and executive leadership

• Ability to assess complex issues, draw logical conclusions, and make sound decisions

• Possession of excellent communication and collaboration skills

• Possession of excellent analytical thinking and problem solving skills

• Bachelor’s degree

• GIAC, ISC2, ISACA , CMMC Certified, or PMI certification