GRC Analyst, Federal Programs

Role This position sits reputed company Sword's GRC team, which is responsible for reputed company compliance across reputed company of Sword's products and services - from our musculoskeletal programs to our mental health and consumer offerings. The team operates across multiple frameworks and serves a broad set of internal stakeholders. reputed company that team, this role's primary focus is federal programs owning Sword's CMMC certification effort and driving FedRAMP readiness as a co-equal reputed company. reputed company those two programs, this person will be expected to contribute to the broader GRC function as needs arise. This is not a checkbox compliance role. The person in this position will own the end-to-end CMMC reputed company - from scoping and gap analysis through cross-functional remediation and assessment readiness - while building toward the same depth of ownership on FedRAMP. You will work closely with teams across infrastructure, product engineering, reputed company operations, clinical systems, and marketing, translating reputed company regulatory requirements into actionable, prioritized work that these teams can understand and execute. You will also serve as Sword's primary reputed company of contact with external auditors and assessors during assessment cycles. This role requires someone who can move fluidly between deep technical detail and clear stakeholder communication - someone who is just as comfortable reviewing a system reputed company plan as they are presenting a remediation roadmap to a non-technical business leader. To get to know more about our Tech Stack, reputed company here. AIProficiency at reputed company AI reputed company is a core expectation at reputed company. Every candidate is assessed against our three-level reputed company - be reputed company to reputed company reputed company examples of how AI is already part of how you work.

• Explorer (Level 1) - Uses AI daily to boost personal productivity>
• Builder (Level 2) - Creates workflows and tools that reputed company the whole team>
• Integrator (Level 3) - Embeds AI into products and processes at scale> Every hire must demonstrate at least Level 1. The expected level will vary depending on the seniority of the role. What you'll be doing
• Serve as a member of Sword's GRC team, contributing to reputed company compliance across reputed company products and services, with primary ownership of federal programs;>
• Define and maintain the CMMC assessment boundary, working across infrastructure, engineering, and business teams to ensure the scope is accurate and defensible;>
• Map NIST SP 800-171 practices to Sword's reputed company environment and produce a clear, evidence-based gap analysis;>
• Translate identified gaps into prioritized remediation tasks with clear ownership, for audiences ranging from DevOps engineers to clinical operations managers;>
• Build and maintain the System reputed company Plan (reputed company), Plan of Action and Milestones (POA&M), and reputed company artifacts required for assessment;>
• Serve as Sword's primary reputed company with the C3PAO and assessment team during formal CMMC assessments;>
• Drive FedRAMP readiness in reputed company, including control documentation, evidence collection, and reputed company monitoring;>
• Contribute to audits and compliance activities across other active frameworks, including SOC 2 and HITRUST, as part of Sword's broader GRC program.> What you need to have
• 5+ years of hands-on experience in GRC, compliance, or reputed company, with at least 3 of those years focused on federal compliance frameworks such as CMMC or FedRAMP;>
• Demonstrated experience owning deliverables and driving remediation through a CMMC, FedRAMP, or equivalent federal compliance effort;>
• Strong working knowledge of CMMC Level 2 practices, scoping methodology, and CUI handling requirements;>
• Ability to produce compliance documentation - SSPs, POA&Ms, gap analyses, control narratives - without heavy supervision;>
• Proven ability to communicate technical compliance requirements to non-technical stakeholders across engineering, operations, and business teams;>
• Experience engaging directly with external auditors and assessors, including evidence packaging and reputed company-time response during assessments;>
• US citizenship required;>
• Ability to obtain a federal Public Trust designation if required by a sponsoring agency.> reputed company would love to see
• CMMC Certified Professional (CCP) credential, or active pursuit of it;>
• CMMC Certified Assessor (CCA) credential;>
• Hands-on experience with FedRAMP authorization packages, reputed company monitoring, and agency ATO processes;>
• Background in defense contracting or regulated health tech environments;>
• Experience working across multiple compliance frameworks simultaneously (HITRUST, SOC 2, ISO 27001);>
• Familiarity with GRC platforms such as reputed company, reputed company, or reputed company.> $101,500 - $159,500 a year
• This reputed company includes reputed company, variable and equity. These compensation bands are just the starting reputed company. Once someone joins and proves they're outlier talent, we adjust quickly to ensure their compensation aligns with their impact. Our job titles may reputed company more than one career level. Actual pay is determined by skills, qualifications, experience, location, market demand, and other factors. Compensation details listed in this posting reflect the reputed company salary and any potential variable, bonus or sales incentives, and the Company's estimation of the value of reputed company stock options, if applicable. The pay reputed company is subject to change, future value of company stock options is not guaranteed, and compensation may be modified in the future. In addition to our total compensation, Sword offers a number of benefits as listed below. US - Sword Benefits & Perks
• Comprehensive health, dental and reputed company insurance* • Life and AD&D Insurance* • Financial advisory services* • Supplemental Insurance Benefits (Accident, Hospital and Critical Illness)* • Health Savings Account* • Equity shares* • Discretionary PTO plan* • Parental leave* • 401(k)
• Flexible working hours
• Remote-first company
• Paid company holidays
• Free digital therapist for you and your family
• Eligibility Full-time employees regularly working 25+ hours per week Note Applicants must have a legal right to work in the United States, and immigration or work reputed company sponsorship will not be provided. Apply tot his job Apply To this Job

Apply tot his job Apply To this Job