GRC Analyst

Key Responsibilities
Regulatory Interpretation and Control Design

• Interpret DOE O 205.1D requirements and translate each into specific, testable security and technology controls for the company’s environment.
• Interpret CMMC 2.0 Level 2 practices (NIST SP 800-171 Rev. 2) and identify where they overlap with or differ from DOE requirements.
• Advise engineering and IT on how proposed systems, vendors and architecture changes affect compliance.

CUI Identification and Classification

• Identify CUI across the business, using the NARA CUI Registry, DoD CUI program guidance (DoDI 5200.48) and DOE CUI policy (DOE O 471.7).
• Review contracts, DD Form 254s, DFARS clauses and customer guidance to determine which data is CUI, its category (e.g., Export Controlled, Critical Infrastructure, Nuclear), and any dissemination controls.
• Build and maintain a CUI data inventory and data-flow maps showing where CUI is created, stored, processed and transmitted.
• Define the CUI enclave / assessment boundary and categorize assets (CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, Out-of-Scope) per CMMC scoping guidance.
• Establish marking, handling, storage, transmission and destruction procedures for CUI, including export-controlled information (ITAR/EAR, 10 CFR 810) where applicable.
• Train employees and data owners to recognize, mark and handle CUI correctly, and address spills or mishandling incidents.

Control Mapping and Crosswalks

• Map IT, OT and security infrastructure (networks, identity, endpoints, cloud, applications, data flows) to DOE O 205.1D, NIST SP 800-53 Rev. 5 controls, and NIST CSF 2.0 functions and categories.
• Build and maintain a unified control framework and crosswalk across DOE O 205.1D, NIST SP 800-53, NIST SP 800-171 / CMMC 2.0 and NIST CSF 2.0, so one control satisfies many requirements.
• Document control ownership, implementation status and evidence location for every mapped control.

Risk Management Framework (NIST SP 800-37)

• Run the RMF lifecycle: prepare, categorize, select, implement, assess, authorize and monitor.
• Categorize systems (FIPS 199) and define authorization boundaries.
• Author and maintain System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), risk assessments and authorization packages.
• Establish continuous monitoring and track risk acceptance decisions.

Program Leadership toward DOE 205.1D / CMMC Certification

• Perform gap assessments against DOE O 205.1D and CMMC 2.0 Level 2, then build a prioritized, resourced remediation roadmap.
• Lead the company through readiness reviews, C3PAO or DOE assessments, and closure of findings.
• Report program status, risk posture and milestones to executive leadership.
• Coordinate with DOE program offices, contracting officers and prime contractors on flow-down requirements (e.g., DFARS , -7019, -7020, -7021).

Governance, Policy and Operations

• Write and maintain the security policy and procedure set aligned to the unified framework.
• Manage third-party and supply chain risk (SCRM), including vendor assessments and confirming vendors handling CUI meet required controls (e.g., FedRAMP Moderate or equivalent).
• Own the evidence collection process and audit-ready documentation.
• Run security awareness and role-based training related to compliance obligations.
• Track changes to DOE directives, NIST publications and CMMC rules, and update controls accordingly.

• 7+ years in cybersecurity, with 4+ years focused on GRC, compliance or risk management.
• Hands-on experience implementing NIST SP 800-37 (RMF) and NIST SP 800-53 controls, including writing SSPs and POA&Ms.
• Working knowledge of DOE O 205.1D (or its predecessor 205.1C) and how it applies to contractor systems.
• Experience with CMMC 2.0 and NIST SP 800-171, including SPRS scoring.
• Demonstrated experience identifying, scoping and protecting CUI, including CUI categories, marking and data-flow mapping.
• Proven ability to map technical infrastructure (network, identity, cloud, endpoint) to control frameworks and NIST CSF 2.0.
• Track record of leading an organization through a formal audit, assessment or authorization (ATO, CMMC, FedRAMP, ISO 27001 or similar).
• Strong technical writing and the ability to explain risk clearly to engineers and executives.

• Certifications: CISSP, CISM, CGRC (formerly CAP), CMMC Certified Professional (CCP) or Certified Assessor (CCA), CRISC.
• Experience in nuclear, energy, national laboratory or other DOE-contractor environments.
• Familiarity with export control (ITAR, EAR, 10 CFR 810) and its overlap with CUI.
• Familiarity with OT/ICS security (NIST SP 800-82, IEC 62443) and NRC cyber requirements (10 CFR 73.54) where relevant.
• Experience with data discovery/classification and DLP tools (e.g., Microsoft Purview) and GRC platforms (e.g., Archer, ServiceNow GRC, Hyperproof).
• Bachelor’s degree in cybersecurity, computer science, engineering or a related field, or equivalent experience.