This position supports Booz Allen Hamilton's ECS GRC team by translating regulatory requirements into actionable guidance and driving automated GRC workflows.
Responsibilities
- Bridge the gap between high level policy and technical execution to ensure practical implementation.
- Analyze and translate complex regulatory requirements into clear enterprise guidance, SOPs, and technical standards.
- Serve as a key liaison to collect comprehensive business and security requirements, ensuring workflows are optimized and automated before embedding into technical tools.
- Identify opportunities to streamline, automate, and optimize GRC processes to boost efficiency and strengthen compliance outcomes across the organization.
- Apply configuration management expertise to design, configure, and mature workflows within GRC tools, specifically ServiceNow, while facilitating technical integrations with external ticketing, reporting, and workflow systems.
- Champion automation of system security planning, POA&M tracking, and evidence collection across the enterprise, continually seeking ways to digitize routine tasks.
- Design end-to-end compliance architectures, align stakeholders, and drive consistent, scalable, and automated GRC execution in a rapidly changing environment.
Requirements
- 8+ years of experience in roles such as Security Control Assessor, Validator, ISSO, ISSE, or ISSM.
- Experience leading business process and change management initiatives, designing and modernizing workflows for authorization, POA&M tracking, and audit evidence collection to increase agility and reduce risk.
- Experience configuring, optimizing, and automating GRC platforms such as ServiceNow, Archer, Xacta, and eMASS to enhance SSP development, risk assessment, and control mapping.
- Experience translating complex security and policy requirements into SOPs, implementation guidance, and enterprise standards to support continuous improvement.
- Knowledge of NIST SP 800-53 rev 4 and 5, NIST SP 800-60, NIST SP 800-171, RMF, FIPS 199, FIPS 200, FedRAMP, and FISMA.
- Ability to drive strategic transformation and modernization of processes aligned with federal security program uplifts.
- Ability to reimagine and automate security controls alignment and assessment to deliver agile, risk-based solutions.
- Ability to lead the integration of security control frameworks and risk management standards in non-federal environments such as SOC 2 Type II, ISO/IEC 27001, PCI DSS, and other industry-specific regulations to support audit readiness.
- HS diploma or GED.
Technologies
- ServiceNow
- Archer
- Xacta
- eMASS
Benefits
- Health, life, disability, financial, and retirement benefits
- Paid leave
- Professional development
- Tuition assistance
- Work-life programs
- Dependent care
- Recognition awards program
Identity Statement
As part of the hiring process, you will undergo identity verification leveraging advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during interviews and assessments. Booz Allen reserves the right to capture your image to verify identity and prevent fraud.
Candidate AI Usage Policy
AI is part of Booz Allen's daily operations and AI tools may be used in the workplace. The use of AI or other tools to assist with interview responses is prohibited unless explicit permission is granted.
Work Model
Remote: The role may be remote, with potential in-person work at Booz Allen or a customer facility as needed.
Hybrid: Frequent on-site presence at a Booz Allen facility is expected, with possible visits to customer facilities depending on role requirements.
Onsite: Work primarily occurs at a Booz Allen office or customer facility, with direct collaboration with colleagues and clients as required.
Commitment to Non-Discrimination
All qualified applicants will receive consideration for employment without regard to disability, protected veteran status, or any other status protected by applicable law.
Compensation
The projected salary range is $99,000 to $225,000 USD annually, determined by location, education, knowledge, skills, competencies, experience, contract affordability, and organizational requirements. This posting will close within 90 days from the posting date.
