Governance, Risk, & Compliance Analyst - AZ

Location

This position will be primarily based out of our Mesa I facility located at 4712 South Ellsworth Road, Mesa, AZ 85212. Though pending business needs could slide to other AZ sites.

Schedule (Current as of posting, but is subject to change pending business needs)

On-site; Full-time; Monday-Friday, 8.00 hour shift, 07:30AM-04:00PM

Position Description

SRC builds custom heat transfer products for customers that include defense and aerospace programs. That work brings Controlled Unclassified Information (CUI) and export-controlled technical data onto our systems, placing SRC under DFARS 252.204-7012, NIST SP 800-171, and ITAR.

The GRC Analyst makes sure that what SRC claims about its security is true, current, and provable. The role runs day-to-day 800-171 compliance program, maintains the risk picture, and bridges cybersecurity and legal when contracts create security obligations. It is an analysis and recommendation role: the analyst prepares the decisions; the Cybersecurity Manager makes them.

This is a hands-on role. You verify controls in the systems themselves, not from someone else's screenshots. You won't be the one applying the changes, but you have to be able to read and test them. This position is on-site, full-time to maximize our Teamwork and Relationships in person between departments. This role reports to the Cyber Security Manger located in our Arizona based operations.

Essential Responsibilities

Overall

• Always strive to represent yourself and our culture in a positive, professional manner.
• Embracing an adaptive/evolving environment in a proactive and positive manner.
• Perform assigned job tasks which meet or exceed company expectations.
  • If further training in needed, must show clear evidence of improvement on specific duty.
• Must be able to work in small group settings or individually as needed and maintain positive and professional conduct while working with others.
  • Personal disagreement can occur; we must do our part in maintaining a professional level of respect to the best of our ability.
• Adhere to all safety policies and rules while raising any concerns to direct supervisor or EHS team.

Compliance Program Operation

• Track all 110 NIST SP 800-171 requirements across the 14 control families; keep the SPRS score current and defensible.
• Maintain the SSP, POA&M, and supporting documents; policies, procedures, data flow diagrams, asset inventories.
• Run internal 800-171A and gap assessments; propose remediation owners and dates; track findings to closure.
• Verify controls technically: run 800-171A objectives as tests against the systems (MFA enforcement, session lock, audit retention, encryption), not as document review.
• Keep an audit-ready evidence repository mapped to controls that an assessor can follow without coaching; build repeatable collection with scripts, saved queries, and scheduled exports.
• Prepare the annual Affirming Official affirmation package; support DFARS 7012, DIBCAC, and CMMC Level 2 assessments.

Risk Management

• Maintain the security risk register; translate technical findings into likelihood, impact, and options leadership can act on.
• Fold CISA and DoD threat advisories into the risk picture.
• Flag boundary changes (new CUI contract, new system, enclave change); draft risk acceptances for sign-off.

Legal & Contract Liaison

• Review contracts and flowdowns for CUI, ITAR, NNPI, and cybersecurity obligations; define the controls and evidence needed.
• Act as point of contact for Legal and Contracts: answer can we truthfully attest to this? with control status and evidence.
• Coordinate supplier security reviews where CUI or export-controlled data flows down; track flowdown compliance.
• Escalate any gap that creates legal or contractual exposure to the Cybersecurity Manager and Legal, in writing.
• Support voluntary disclosure and incident reporting with timeline reconstruction, evidence collection, and documentation.

Policy, Training, Monitoring, and Reporting

• Write and maintain policies, SOPs, and control narratives in SRC house style; update on DoD, DFARS, or NIST changes and record why.
• Deliver security awareness and role-based training; track completion across the workforce.
• Triage SIEM alerts for the CUI enclave, tune noisy rules, compare deployed configurations to CIS or STIG baselines, and open remediation items.
• Administer the vulnerability scanner, SIEM rule content, and the GRC and evidence tooling.
• Support incident response evidence and timelines, including DFARS 7012 reporting to DoD when CUI is involved.
• Report control status, open risks, and remediation progress on a set cadence; produce readiness summaries on request.

Qualifications

THIS IS AN INDUSTRIAL MANUFACTURING ENVIRONMENT WHICH REQUIRES PHYSCIAL CAPABILITIES.

Required

• U.S. Person status under ITAR (22 CFR 120.62), given access to export-controlled technical data.
• High School diploma/equivalent.
• Bachelor's degree in cybersecurity or IT, or equivalent experience.
• 3-5 years in cybersecurity, with a background in systems administration, security operations, or security engineering before or alongside compliance work.
• Working knowledge of NIST SP 800-171 and DFARS 252.204-7012.
• Built or maintained an SSP and POA&M; maps controls to evidence.
• Can pull the configuration, log, or report that proves a control is implemented in Entra ID, Intune, Windows, firewalls, and explain what it shows.
• Basic Powershell or Python for exporting evidence (MFA status, patch compliance, account inventories) rather than assembling screenshots by hand.
• Working knowledge of Windows and Microsoft 365 administration, Active Directory and Entra ID, and network fundamentals: VLANs, firewall rules, remote access.
• Strong policy writing; explain controls to non-technical owners.
• While on production floor:
  • • Ability to stand, walk, bend, extend, reach, push, pull, grasp, and twist for long periods of time throughout shift, many positions are standing or walking majority of shift.
    • Ability to frequently lift and/or push or pull up to 25lbs and occasionally lift and/or push or pull up to 50lbs without assistance.
• Fundamental understanding of English language and able to show evidence can read at base comprehension level.
  • Though we strive to bridge language gaps, most paperwork and programs are in English.
  • Reading is crucial as someone is not always readily available to provide translations.
• Stable and reliable attendance.
  • A pattern of Late Ins, Early Outs, Unexcused Call Outs, etc. is not acceptable.
• Strong positive work ethic.
  • Have a good history of safe work practices, focus on quality, and steady efficiency.
• Must pass medical pre-screen with physical and background check.
• Must be authorized to work in the United States.
  • We do not currently support individuals that require paid visa programs.

Preferred

• Prior help desk, systems administration, or SOC time.
• Azure Government or GCC High administration; Palo Alto or equivalent firewall exposure; STIG or CIS benchmark work.
• Exposure to CMMC Level 2 readiness, SPRS scoring, or a prior C3PAO or DIBCAC assessment.
• Experience with:
  • Legal or Contracts on clause interpretation, flowdown, or disclosure obligations.
  • Manufacturing environment and operational technology (OT).
• Familiarity with ITAR and NNPI handling requirements.
• Hands-on time with a GRC or compliance tracking tool, and with Jira or Jira Service Management.
• Security+, CySA+, SC-200, AZ-500 or SC-300, CISSP.
• Experience working in a mid-size company where gap-filling is routine.