Job Description
Job Description: Job Description Spry Squared is looking for a senior Governance Risk and Compliance Consultant for our client providing support for the Air Force Installation & Mission Control Center (AFIMSC).
Scope of Responsibilities: 2.1. This is a non-personal
service contract to perform duties as the Contractor. The U.S. Government shall
neither supervise nor control the method by which the Contractor performs
required task herein. These services shall not be used to perform work of a
policy/decision making or management nature (e.g. inherently governmental
functions). All decisions relative to programs supported by the Contractor
shall be the sole responsibility of the U.S. Government.
The Contractor shall:
2.2. Prioritize attainingand maintaining an Authorization to Operate (ATO) status for the Chaplain CorpsAccounting Section (CCAC) current accounting system in the most timely mannerpossible.
2.2.1.Demonstrate consistent progress attaining and avoiding lapse in ATO.
2.3. Conduct comprehensiveassessments of the organization's GRC posture, including but not limited tocybersecurity controls, policies, and procedures.
2.3.1.Evaluate the organization's GRC posture, focusing on cybersecurity controls,policies, and procedures in compliance with Department of Defense, Air Force,and local policies (AFI 17-101, DoD 8510.01, NIST SP 800-53, NIST SP 800-53,DoD Cloud Computing Security Requirements Guide and all other relevantpolicies).
2.3.2.Evaluate compliance with designated accounting software and interoperabilitywith network requirements.
2.3.2.1.Communicate in writing actionable courses of action and/or recommendations toAFIMSC/A37R or their designated representative.
2.3.3.Identify weaknesses, vulnerabilities, and areas of non-compliance that need tobe addressed.
2.3.4.Conduct thorough assessments to gain a holistic understanding of theorganization's GRC landscape.
2.3.5.Coordinate with SAF/AA, 502 CS, ACC/A6, DISA, and other agencies as required.
2.3.6.Lead migration of accounting services to cloud-based services as determined byAFIMSC/A37R.
2.3.6.1.Attain and maintain ATO for new cloud-based accounting system.
2.3.7.Coordinate with cloud vendor to ensure FEDRAMP package and inheritance ofcontrols.
2.4. Recommend prescriptedstrategies to address identified compliance gaps, vulnerabilities, and risks inalignment with industry standards and regulatory requirements.
2.4.1.Recommend strategies to mitigate compliance gaps, vulnerabilities, and risks inline with DoD and/or AF standards and regulations.
2.4.2.Develop action plans to address identified issues and ensure alignment withbest practices.
2.4.3.Recommend solutions that enhance the organization's ability to manage andmitigate risks effectively.
2.5. Provide guidance andexpertise on the interpretation and application of relevant standards andframeworks, ensuring alignment with organizational objectives and bestpractices.
2.5.1.Offer expert advice on interpreting and applying relevant standards andframeworks and identify noncompliance within the organization.
2.5.2.Provide guidance on aligning governance practices with organizationalobjectives for improved performance and correction of noncompliance.
2.6. Collaborate withcross-functional teams to design, implement, and maintain effective riskmanagement processes and controls throughout the organization.
2.6.1.Work closely with teams across different departments to design and implementrisk management processes and controls.
2.6.2.Foster collaboration to ensure that risk management practices are integratedseamlessly into daily operations.
2.6.2.1.Communicate relevant issues to A37 via staff meetings, electroniccommunications, direct coordination with CCAC and other directorates asidentified by A37R.
2.6.3.Align risk management efforts with the organization's overall business strategyand goals.
2.7. Assist in thedocumentation and maintenance of security controls, policies, and procedures,including updates to reflect changes in regulations or emerging threats.
2.7.1.Document security controls, policies, and procedures to ensure clarity andconsistency.
2.7.1.1.Ensure security of personal identifiable information (PII) and financialinformation in accordance with established government standards.
2.7.1.2.Ensure compliance of CCAC systems with DoD/Air Force regulations and localpolicies.
2.7.2.Update documentation as needed to reflect changes in regulations or emergingthreats.
2.7.3.Maintain accurate records of compliance activities for audit and reportingpurposes.
2.8. Conduct regular reviewsand audits to monitor compliance with established frameworks and identify areasfor continuous improvement.
2.8.1.Regularly review and assess compliance with established frameworks andregulations.
2.8.2.Conduct audits to identify areas for improvement and enhance overall complianceposture.
2.8.3.Monitor the effectiveness of risk management controls and processes throughongoing evaluation.
2.9. Provide training andknowledge transfer sessions to internal stakeholders on GRC principles,compliance requirements, and risk management best practices to facilitatestakeholders understanding of their roles in maintaining compliance andmanaging risks effectively.
Qualifications REQUIRED QUALIFICATIONS - MUST HAVE an active SECRET Clearance .
- Contractor must attain and maintain International Information System Security Certification (ISC2), Certified in Governance Risk and Compliance (CGRC) or Certified Authorization Professional (CAP) certifications, as per the standards outlined by ISC2 and other relevant certifications as specified by higher headquarters(Note that ISC2 has recently transitioned from CAP to CGRC, and both certifications are considered interchangeable.)
- Must be Proficient in utilizing Enterprise Mission Assurance Support Service (eMASS), Information Technology Investment Portfolio System (ITIPS) and have demonstrated experience with:
- Understanding and implementing the Risk Management Framework (RMF).
- The National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4 (SP 800-53r4) for security and privacy controls.
- NIST Special Publication 800-37 Revision 2 (SP 800-37r2) for guidance on applying RMF to federal information systems.
- NIST Special Publication 800-60 (SP 800-60) for security considerations in the federal information system categorization process.
Additional Information Pay Range: $100,000 - $150,000 Depending on Experience All your information will be kept confidential according to EEO guidelines.
Company Description Spry Squared is a Minority and Woman Owned Small Business headquartered in Colorado Springs, Colorado with offices across the United States of America. We are an experienced federal government and commercial service provider with security cleared personnel working on various projects across the USA and the globe.
Spry Squared provides organizations with Best in Class Enterprise Solutions, Managed IT Services, Cybersecurity Solutions, IT Professional Services, Recruiting Services, Project/Program Management and technology products. We are your strategic partner and value-added reseller, solving complex business challenges by leveraging technology solutions that reduce costs, optimize productivity and minimize risk.
Job Tags
Contract work, For contractors, Local area,