IT Risk and Compliance Specialist Principal
Listed on 2026-10-11
-
IT/Tech
Cybersecurity, Information Security & Data Protection
Type of Requisition: Pipeline
Clearance Level Must Currently Possess: None
Clearance Level Must Be Able to Obtain: Secret
Public Trust/Other
Required:
None
Job Family: Cyber and IT Risk Management
Job Qualifications:
Skills: Amazon Web Services (AWS) Security, Cloud Security, Federal Risk and Authorization Management Program (FedRAMP)
Certifications: None
Experience: 8 + years of related experience
US Citizenship
Required:
Yes
TSS is proactively seeking Principal-level IT Risk and Compliance Security Analysts to support upcoming and ongoing federal programs across civilian and defense agencies. In this senior individual contributor role, you will serve as a technical ISSO, leading governance, compliance, and continuous monitoring activities for complex information systems hosted in AWS, Azure, and Google Cloud.
You will translate federal requirements into actionable technical baselines, drive the full RMF lifecycle, and partner with engineering teams to maintain secure, resilient, mission-enabling technologies and support ATO issuance and maintenance.
Key Responsibilities RMF Execution & Authorization Lifecycle- Execute RMF steps (Categorization through Continuous Monitoring) per NIST SP 800-37.
- Author and maintain SSPs, POA&Ms, SARs, ISCPs, and supporting authorization artifacts.
- Establish evidentiary libraries and audit records within program repositories (e.g., SharePoint, agency GRC tools).
- Coordinate with SCAs and AOs during assessments and finding adjudication.
- Lead and sustain continuous monitoring through baseline reviews and periodic control assessments.
- Serve as the primary advisor on system security posture, threats, vulnerabilities, and compliance requirements.
- Interpret, implement, and validate NIST SP 800-53 and 800-171 controls across multi-cloud environments.
- Develop and update security documentation, test plans, and continuous monitoring artifacts.
- Prepare for and respond to internal/external audits and compliance evaluations.
- Drive security-driven configuration changes and accreditation updates in collaboration with system owners and engineers.
- Analyze outputs from vulnerability scanners, container security tools, and static analysis utilities; prioritize remediation with engineering.
- Assess IaC templates (Terraform/Cloud Formation) and cloud configurations against DISA STIGs and CIS Benchmarks.
- Review IAM, network ACLs, boundary protections, and FIPS-compliant cryptography implementations.
- Ensure automated compliance auditing and logging are integrated into delivery pipelines.
- Review vulnerability, EDR, and SIEM outputs; drive risk-based remediation.
- Investigate potential incidents with SOC/engineering and document actions according to agency timelines.
- Audit logs to detect compliance issues or abnormal activity; verify secure recovery and configuration restoration.
- Oversee decommissioning activities and media sanitization aligned to NIST SP 800-88.
- Lead teams through ATO preparation, readiness reviews, assessment support, and findings adjudication.
- Collaborate with stakeholders, assessors, and program leadership to achieve and sustain ATOs.
- Evaluate architecture, processes, and controls to identify gaps; develop mitigation strategies and decision briefs.
- Provide guidance to engineering, program management, and customer leadership on cybersecurity priorities.
- Perform Privacy Threshold Analyses and support PIAs to track CUI/PII and mission-sensitive data.
- Enforce role-based access, regular access reviews, and MFA/password policy requirements.
- Monitor retention and disposal aligned with…
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).