Senior GRC Analyst (NIST/GovRAMP/FedRAMP)
A senior, fully remote GRC analyst in the Philippines (night shift, overlapping U.S. hours) who owns compliance documentation and programs—SSPs, POA&Ms, policies, vendor risk—for GovRAMP, FedRAMP, NIST 800-53, and SOC 2 at the company's Career EDGE SaaS platform serving U.S. state agencies.
- Compensation
- Not disclosed
- Location
- Phillippines - Remote
- Work setup
- Remote
- Seniority
- Senior
- Employment
- Contract
- Experience
- 3+ years
- Category
- Security
- Posted
Skills
Must have
- Located in the Philippines with night shift work hours to overlap with the U.S. team
- 7+ years of hands-on GRC experience
- At least 3 years dedicated to FedRAMP, GovRAMP, StateRAMP, TX-RAMP, or CMMC programs at a SaaS company
- Track record authoring SSPs, POA&Ms, and continuous monitoring deliverables for a successful authorization
- Deep working knowledge of NIST 800-53, NIST 800-171, FIPS 199/200, SOC 2 (Type II), and audit evidence collection
- Self-starter able to mature an existing program and deliver without daily direction
- Exceptional written English for documents read by state auditors, executives, and 3PAOs
- Experience running a third-party risk management program and managing vendor security reviews at volume
- Bachelor's degree in Cybersecurity, Information Systems, or a related field
Nice to have
- Relevant certifications (CISSP, CISA, CRISC, CGRC/CAP, ISO 27001 Lead Implementer)
- Experience with GRC tooling (Drata, Vanta, Hyperproof, ServiceNow GRC)
- Prior work with U.S. state government customers
Full description
It's not just about the policies; it's about the mission!
At Career Team, we work to accelerate the human condition. Our award-winning portal, Career Edge, transforms lives across the U.S.—and behind every secure, compliant experience is a governance expert like you.
We are looking for a Senior GRC Analyst with deep experience in GovRAMP, FedRAMP, NIST 800-53, and SOC 2 to join our growing security and compliance team. You'll take ownership of core elements of our GRC program—the documentation, vendor risk, and policy work that keeps Career EDGE audit-ready and trusted by the state agencies we serve. This is a senior, self-directed role for someone who knows what good looks like, raises the bar on what's already in place, and treats compliance documentation as a craft rather than a checkbox.
Why Join Us?
By joining this incredible company, you will be:
- A senior individual contributor with real ownership over a defined portion of our GRC program.
- Maturing the documentation backbone (SSPs, policies, POA&Ms, risk register, vendor program) that powers our GovRAMP, FedRAMP, and state authorization efforts.
- Working on a product that directly helps thousands of individuals access workforce and educational services.
- Partnering directly with security leadership, engineering, and executive stakeholders—no layers, no hand-holding.
- Driving continuous improvement of policies, controls, and evidence collection across the organization.
- Enjoy a fully remote work environment.
Your Impact on Career Team's Success:
As a Senior GRC Analyst, your focus will be deeply hands-on and ownership-oriented:
Compliance Program Ownership
- Maintain and continuously improve the System Security Plan (SSP), policies, procedures, and standards aligned to NIST 800-53 and SOC 2.
- Own the Plan of Action and Milestones (POA&M) lifecycle: tracking, aging, remediation evidence, and monthly continuous monitoring deliverables.
- Manage the control evidence catalog—what evidence exists, where it lives, when it was last refreshed, and what's coming up for renewal.
- Coordinate with the U.S. security team and 3PAOs to support GovRAMP, FedRAMP, and state-level (TX-RAMP, ) authorization and continuous monitoring activities.
Risk, Vendor & Subcontractor Management
- Run our third-party risk management program end-to-end: security questionnaires, due diligence, contract review, recurring reassessments.
- Maintain the enterprise risk register, facilitate risk acceptance decisions, and translate technical risk into business language for executives.