[Remote] GRC Analyst

Note: The job is a remote job and is open to candidates in USA. RED SKY Consulting is seeking a GRC Analyst to support cloud security and compliance for public sector customers. The role focuses on FedRAMP and NIST 800-53 compliance, audit coordination, continuous monitoring, vulnerability remediation, documentation, and cross-functional governance activities.

Responsibilities

• Support authorization, compliance, and continuous monitoring activities
• Interpret and apply security controls and control enhancements
• Keep documentation current, including system security plans, policies, and control descriptions
• Track compliance against established baselines (Low / Moderate / High)
• Coordinate and support third-party audits, including 3PAO assessments
• Gather and review evidence from engineering, infrastructure, and operations teams
• Respond to auditor questions and information requests
• Help track remediation efforts and support closure of identified gaps
• Contribute to annual assessments, penetration test reviews, and vulnerability reporting
• Support monthly FedRAMP continuous monitoring activities
• Review vulnerability scans and track remediation progress
• Coordinate incident reporting and change management impacts
• Ensure changes follow approved compliance processes
• Identify and escalate potential compliance risks
• Partner with Cloud Engineering, DevOps, Security Operations, Legal, and Product teams
• Translate technical controls into clear, audit-ready documentation
• Support internal reporting and briefings on compliance status and risk
• Maintain organized compliance evidence repositories
• Assist with internal audits and readiness assessments
• Contribute to updates of policies and standards aligned to federal requirements
• Support responses to customer and government security questionnaires

Skills

• Specific, hands-on experience with ConMon and POA&M processes is critical
• Working familiarity with the framework, including the ability to identify control families (e.g., IA – Identity Access)
• Direct experience working with third-party auditors (3PAO), understanding a Document Request List (DRL), and collating evidence for controls
• Ability to manage the vulnerability process across dozens of internal groups, with heavy spreadsheet-based tracking
• US Citizenship — Mandatory, non-negotiable requirement for this position
• 2+ years of experience in GRC, cybersecurity compliance, or audit support
• Familiarity with FedRAMP, NIST SP 800-53, or similar compliance programs
• Exposure to cloud environments such as AWS or Azure
• Interest or experience in the FedRAMP lifecycle, NIST 800-53 control families, POA&M management and risk tracking, and working with GRC/ticketing tools or evidence repositories
• ServiceNow, Power BI, and exposure to AWS or Azure
• Experience working with auditors or assessment organizations (e.g., 3PAOs) is a plus

Company Overview