Risk and Compliance Analyst

Operational Support

Required Qualifications

• · Minimum seven years of Information Security experience, including at least five years of risk and compliance experience at a large company or Government agency similar in size and scope to GSA, IRS, DoD, or VA.
• · Expertise in risk management, compliance, audit, internal and external assessments, risk mitigation, continuous monitoring, policy development, documentation, enforcement, and reporting of compliance issues.
• · Experience coordinating with regulatory bodies and organizational stakeholders to assess and resolve compliance matters.
• · Bachelor's degree in Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or a related field.
• · Certification in one or more of the following: IAT III, IAM III, or IASAE III.
• · PWS substitution: an advanced degree in a related field may substitute for up to two years of required experience. IAT III, IAM III, or IASAE III certification may substitute for a relevant Bachelor's degree or four years of relevant experience.

Other Requirements

• · Must be able to read, write, speak, and understand the English language.
• · Must successfully complete and maintain the VA personnel vetting and background investigation requirements applicable to assigned work; PWS Tasks 5.1 through 5.9 are designated Tier 4 / High Risk.
• · Must complete required fingerprinting, personnel security forms, security and privacy training, and Rules of Behavior acknowledgments within Government-established timelines.
• · Must qualify for and properly safeguard any required VA Personal Identity Verification (PIV) credential and Government-furnished equipment.
• · Must be available and responsive during core hours of 8:00 a.m. to 5:00 p.m. Eastern Time on normal Federal Government workdays.
• · Must be able to work from a Contractor-provided facility and travel occasionally to VA Central Office in Washington, D.C., or other approved locations when coordinated in advance.
• · Remote access to VA systems must occur only through VA-approved methods and from locations permitted by VA policy.