Governance, Risk, & Compliance Analyst - AZ

Location

This position will be primarily based out of our Mesa I facility located at 4712 South Ellsworth Road, Mesa, AZ 85212.  Though pending business needs could slide to other AZ sites. 

Schedule (Current as of posting, but is subject to change pending business needs)

On-site; Full-time; Monday-Friday, 8.00 hour shift, 07:30AM-04:00PM

Position Description

SRC builds custom heat transfer products for customers that include defense and aerospace programs.  That work brings Controlled Unclassified Information (CUI) and export-controlled technical data onto our systems, placing SRC under DFARS 252.204-7012, NIST SP 800-171, and ITAR.

The GRC Analyst makes sure that what SRC claims about its security is true, current, and provable.  The role runs day-to-day 800-171 compliance program, maintains the risk picture, and bridges cybersecurity and legal when contracts create security obligations.  It is an analysis and recommendation role: the analyst prepares the decisions; the Cybersecurity Manager makes them. 

This is a hands-on role.  You verify controls in the systems themselves, not from someone else's screenshots.  You won't be the one applying the changes, but you have to be able to read and test them.  This position is on-site, full-time to maximize our Teamwork and Relationships in person between departments.  This role reports to the Cyber Security Manger located in our Arizona based operations. 

Essential Responsibilities

Overall

• Always strive to represent yourself and our culture in a positive, professional manner. 
• Embracing an adaptive/evolving environment in a proactive and positive manner. 
• Perform assigned job tasks which meet or exceed company expectations. 
  • If further training in needed, must show clear evidence of improvement on specific duty.
• Must be able to work in small group settings or individually as needed and maintain positive and professional conduct while working with others. 
  • Personal disagreement can occur; we must do our part in maintaining a professional level of respect to the best of our ability. 
• Adhere to all safety policies and rules while raising any concerns to direct supervisor or EHS team.

Compliance Program Operation

• Track all 110 NIST SP 800-171 requirements across the 14 control families; keep the SPRS score current and defensible.
• Maintain the SSP, POA&M, and supporting documents; policies, procedures, data flow diagrams, asset inventories.
• Run internal 800-171A and gap assessments; propose remediation owners and dates; track findings to closure.
• Verify controls technically: run 800-171A objectives as tests against the systems (MFA enforcement, session lock, audit retention, encryption), not as document review.
• Keep an audit-ready evidence repository mapped to controls that an assessor can follow without coaching; build repeatable collection with scripts, saved queries, and scheduled exports.
• Prepare the annual Affirming Official affirmation package; support DFARS 7012, DIBCAC, and CMMC Level 2 assessments.

Risk Management

• Maintain the security risk register; translate technical findings into likelihood, impact, and options leadership can act on.
• Fold CISA and DoD threat advisories into the risk picture.
• Flag boundary changes (new CUI contract, new system, enclave change); draft risk acceptances for sign-off.

Legal & Contract Liaison

• Review contracts and flowdowns for CUI, ITAR, NNPI, and cybersecurity obligations; define the controls and evidence needed.
• Act as point of contact for Legal and Contracts: answer can we truthfully attest to this? with control status and evidence.
• Coordinate supplier security reviews where CUI or export-controlled data flows down; track flowdown compliance.
• Escalate any gap that creates legal or contractual exposure to the Cybersecurity Manager and Legal, in writing.
• Support voluntary disclosure and incident reporting with timeline reconstruction, evidence collection, and documentation.

Policy, Training, Monitoring, and Reporting

• Write and maintain policies, SOPs, and control narratives in SRC house style; update on DoD, DFARS, or NIST changes and record why.
• Deliver security awareness and role-based training; track completion across the workforce.
• Triage SIEM alerts for the CUI enclave, tune noisy rules, compare deployed configurations to CIS or STIG baselines, and open remediation items. 
• Administer the vulnerability scanner, SIEM rule content, and the GRC and evidence tooling.
• Support incident response evidence and timelines, including DFARS 7012 reporting to DoD when CUI is involved.
• Report control status, open risks, and remediation progress on a set cadence; produce readiness summaries on request.