Cybersecurity GRC Senior Analyst

SAIC is seeking a Cybersecurity GRC Senior Analyst to join the Governance, Risk and Compliance (GRC) Team. For the right candidate, this position may be remote anywhere in the United States.

The Cybersecurity Governance, Risk, and Compliance (GRC) Senior Analyst supports enterprise cyber risk management by leading application, system, and vendor risk assessments; validating control effectiveness; coordinating remediation through mitigation plans; and driving continuous improvement of the Cybersecurity Risk Management Program. The role operates as a second line of defense partner to technical process teams and stakeholders, ensuring risk-informed decisions and measurable risk reduction in alignment with regulatory and enterprise standards.

• Maintain current awareness of cybersecurity trends and threats to inform risk mitigation strategies.
• Assist with application and system/infrastructure risk assessments and reassessments; document results and track remediation to closure.
• Conduct third‑party (vendor) risk assessments; collaborate with procurement, legal, and business owners on risk treatment.
• Conduct supply chain risk management risk and compliance assessments.
• Assist with operational cyber activities including, but not limited to carbon black application whitelisting reviews, processing international travel requests and managing violations, software assessments/evaluations.
• Select, implement, and assess security controls per NIST SP 800‑171; validate effectiveness.
• Drive continuous monitoring using NIST SP 800‑39; maintain dashboards and key risk indicators.
• Manage vulnerability and penetration test findings; coordinate with system owners to remediate within SLAs.
• Author and maintain risk management program documentation; prepare audit evidence and participate in internal/external audits (ISO/IEC 27001, SOC reports, and related standards).
• Recommend updates to cybersecurity policies, standards, and procedures based on control gaps and remediation outcomes.
• Develop and deliver training and guidance to stakeholders to strengthen a risk‑aware culture.
• Assist with configuration and maintenance of GRC tooling (e.g., Service Now GRC or equivalent) to support workflow, evidence management, and reporting.
• Collaborate across security, IT, and business teams; elevate material risks to senior leadership with clear risk statements and options.

• Bachelor's degree in Information Technology or similar discipline and 5 years of experience, or Master's Degree and 3 years of experience. An additional 4+ years of experience may be considered in lieu of a degree.
• Certifications such as CISA, CISSP, CISM, or Security+.
• Comprehensive understanding and applied experience with cybersecurity frameworks and regulations (NIST RMF, NIST SP 800‑53/171, ISO/IEC 27001, COBIT, COSO, MITRE, ITIL, HITRUST, SOC reporting).
• Ability to categorize systems and information per FIPS 199 and NIST SP 800‑60.
• Strong analytical skills; able to synthesize complex information and defend independent judgments.
• Excellent written and verbal communication; able to translate technical risk into business‑focused language and narratives.
• Strategic and self‑directed work style with effective collaboration and negotiation across diverse stakeholders.
• Demonstrated ability to manage multiple projects, prioritize based on urgency and impact, and meet deadlines.

• Working knowledge of Service Now and/or other GRC tools.
• Working knowledge of security tools for vulnerability scanning, DLP, endpoint protection, etc.
• Technical proficiency in Cybersecurity.