Principal Security GRC & Architecture Lead, Need only Local to Austin, TX

Job Description: Principal Security GRC & Architecture Lead 
Level: Senior/Principal (12+ Years Experience)
 Focus: Governance, Risk, Compliance (GRC), and SSP Development
 Position Summary 
The Principal Security GRC Lead will serve as the primary architect for security governance, compliance, and risk management. This role is specifically designed to bridge the gap between technical security operations and regulatory mandates. You will lead the end-to-end development of System Security & Privacy Plans (SSP/SSPP) and drive the remediation of vulnerabilities through disciplined POA&M (Plan of Action and Milestones) management. You will be responsible for ensuring that all enterprise systems are "assessor-ready" at all times.
 Key Responsibilities

• SSP/SSPP Ownership: Lead the end-to-end development, maintenance, and annual updates of System Security & Privacy Plans for enterprise-level systems.

• Vulnerability Remediation: Translate complex penetration testing results and vulnerability scans into actionable EPICs and User Stories for technical teams.

• POA&M Management: Drive the closure of compliance gaps by managing the POA&M lifecycle, ensuring all findings are tracked, remediated, and validated with evidence.

• Audit Readiness: Produce high-quality, "assessor-ready" documentation, including configuration baselines, monitoring evidence, and incident traceability.

• Cross-Functional Governance: Coordinate between infrastructure, application, and security teams to oversee endpoint protection, web application security (WAF), and cloud security controls.

• Compliance Frameworks: Ensure all systems adhere to CMS MARS-E v2.2, NIST 800-53, and NIST RMF standards.

Candidate Skills & Qualifications 
Minimum Mandatory Requirements

• 12+ Years: Deep focus on GRC, Enterprise Security Architecture, and Vulnerability Management in hybrid/cloud environments.

• 10+ Years: Proven experience owning the SSP/SSPP development process from start to finish.

• 10+ Years: Hands-on experience with CMS MARS-E v2.2 or comparable federal security frameworks (e.g., FedRAMP, FISMA).

• 10+ Years: Strong expertise in audit evidence collection, control implementation documentation, and POA&M tracking.

• 8+ Years: Proficiency in NIST 800-53 and the NIST Risk Management Framework (RMF).

• 8+ Years: Experience in Secure SDLC and DevSecOps practices to ensure security is baked into the development lifecycle.