Own and mature internal and Managed GRC programs, including federal SSPs, POA&Ms, audits, and risk assessments.
Collaborate with CISOs, engineers, and control owners to translate compliance requirements into practical technical controls.
Lead and develop a GRC team while introducing automation and AI to improve scalability and consistency.
The company provides managed Governance, Risk & Compliance (GRC) and security assurance services, with a strong focus on federal security programs and frameworks like NIST, SOC 2, and CMMC. It supports a growing GRC team and emphasizes low-ego collaboration, automation, and AI-enabled approaches to scale delivery.
Review system documentation and technical evidence against NIST, FISMA, RMF, FedRAMP, and Zero Trust requirements.
Perform control-gap analyses, maturity assessments, and compliance reviews; identify risks and recommend corrective actions.
Support authorization activities by preparing security plans, control implementation statements, and remediation documentation.
9th Way Insignia is a service-disabled, veteran-owned small business providing transformative technology solutions including cybersecurity, cloud modernization, software development, and data analytics to government customers. As a small business, it empowers its people to fearlessly drive change and offers a comprehensive benefits package.
Monitor, investigate, and respond to cybersecurity alerts, incidents, vulnerabilities, and threats across enterprise, endpoint, cloud, network, and application environments.
Support compliance with NIST SP 800-171, CMMC, and applicable federal/DoD cybersecurity requirements, including protection of CUI and FCI.
Conduct cybersecurity risk assessments, vulnerability assessments, and security reviews; prioritize findings and coordinate remediation efforts.
Tlingit Haida Tribal Business Corporation (THTBC) delivers mission-critical services to federal clients globally, including logistics, IT, cybersecurity, and facilities operations. For over 35 years, the company has been committed to generating economic opportunity for the Tlingit & Haida Tribes of Alaska, fostering a purpose-driven culture.
Develops and maintains information security policies, procedures, and controls ensuring compliance with HITRUST, SOC 2, HIPAA, and other frameworks.
Leads audit readiness and execution, managing HITRUST and SOC 2 Type II examinations from planning through report issuance.
Drives continuous improvement of security processes, risk management, and incident response across the organization.
MRO specializes in information security assurance and regulatory compliance, helping organizations manage risk and maintain audit readiness. The company fosters a security-focused culture with a team of experienced professionals.
Conduct cybersecurity risk assessments and compliance reviews to identify gaps and remediation needs.
Support internal and external audits against Federal requirements and organizational policies.
Develop and maintain cybersecurity policies, procedures, and compliance documentation.
PingWind is a Service-Disabled Veteran-Owned Small Business that delivers cybersecurity, IT infrastructure, supply chain management, and professional services to the federal government. As a small business with offices in Northern Virginia and Huntsville, AL, PingWind fosters a dynamic team environment focused on supporting large government clients.
Lead Atmosera's internal GRC program and managed GRC service delivery.
Manage federal System Security Plans, POA&Ms, and audit responses.
Serve as a senior GRC advisor bridging executive and technical teams.
Atmosera empowers businesses to redefine what's possible with modern technology and human expertise across Applications, Data & AI, DevOps, Security, and Microsoft Azure. As a Microsoft Partner with seven specializations, the company values humility, hunger, and mindfulness in a collaborative team environment.
Support day-to-day execution of IT risk, compliance, privacy, and governance programs.
Review client agreements and security questionnaires, coordinating redlines with legal.
Manage control evidence, vendor risk, data retention, and compliance policies.
Our partner provides IT risk, compliance, privacy, and governance services for clients. They have a small, collaborative team and value diverse perspectives and authentic contributions.
Own and mature security, privacy, and compliance programs across HIPAA, SOC 2, and HITRUST.
Lead HITRUST certification end to end, including scoping, evidence collection, and assessor coordination.
Partner with Engineering, Product, SRE, and IT to integrate security into architecture, SDLC, and cloud infrastructure.
IntusCare is an end-to-end ecosystem built specifically to help PACE programs deliver exceptional care, strengthen financial performance, and stay compliant. It is a growing healthcare SaaS organization that empowers teams to improve outcomes for dual-eligible seniors.
Lead security risk assessments across engineering, IT, operations, and business functions.
Maintain a risk register and provide leadership with a clear view of the company's risk posture.
Partner with teams to drive remediation of risks and map controls to compliance frameworks like NIST 800-171.
Muon Space is an end-to-end Space Systems Provider that designs, builds, and operates LEO satellite constellations delivering mission-critical data. Founded in 2021, the company operates a state-of-the-art facility in Silicon Valley and is committed to fostering a diverse and dynamic workforce.
Own the overall security posture, including policy, standards, and risk framework.
Manage ISO 27001, SOC 2, FedRAMP, and CMMC compliance programs.
Lead incident response, vulnerability management, and customer security assurance.
RapidFort is a cybersecurity company that helps organizations secure and optimize their software supply chain and containerized environments. As a fast-growing startup, we foster a culture of ownership and direct communication, where every team member contributes to our mission of securing cloud-native applications for regulated industries.
Build and maintain compliance frameworks in the Secfix platform, including ISO 27001, TISAX, SOC 2, GDPR, and more.
Own internal audits end-to-end for customers, ensuring they are prepared for external audits.
Collaborate with product and engineering to translate compliance gaps into structured product work and enhance platform quality.
Secfix automates security compliance for European companies, helping them achieve ISO 27001, GDPR, TISAX, and SOC 2 efficiently. They are a 100% remote team with hubs in Munich, Berlin, and London, recently raised a $12M Series A, and are backed by top VCs.
Own end-to-end audit evidence collection and validation across multiple compliance frameworks including FedRAMP, ISO 27001, and SOC 2.
Maintain and continuously verify technical controls across GCP, GitHub, and Microsoft 365 environments.
Serve as the primary liaison between GRC and technical teams to reduce audit burden and ensure continuous audit readiness.
A-LIGN is a leading provider of cybersecurity compliance programs, offering services including SOC 2, ISO 27001, HITRUST, FedRAMP, and PCI. They are the number one issuer of SOC 2 and HITRUST and a top three FedRAMP assessor, operating in a high-growth, PE-backed environment.
Lead projects from client acquisition to final delivery and oversee client service teams on multiple engagements.
Perform technical security assessments, audits, and risk evaluations across applications and infrastructure.
Mentor and develop staff while cultivating client relationships and cross-selling firm services.
The Bonadio Group is a leading accounting, advisory, and consulting firm providing next-level solutions to clients across industries. The firm values diversity, innovation, and professional growth, offering mentoring and training programs with a path to partnership.
Act as part vCISO and account manager, guiding clients through security and compliance programs.
Assess security posture, provide recommendations, and design programs using NIST, SOC 2, and ISO 27001.
Liaise with auditors and internal teams to translate programs into policies, procedures, and configurations.
Oneleet provides a platform for companies to build, manage, and monitor cybersecurity programs and achieve SOC 2 and ISO 27001. It raised a $33M Series A and is a fast-growing, remote-first team with an opinionated culture.
Establish and enforce a unified security posture across GCP and OCI, including guardrails, IAM policies, and centralized monitoring.
Validate cloud deployments meet FedRAMP High, FISMA, and NIST 800-53 requirements, working with governance and audit teams.
Identify vulnerabilities, policy deviations, and architectural risks, and drive remediation.
Latitude is a growing Service-Disabled Veteran Owned company within the Federal Sector, working with various federal clients across multiple agencies. They foster a remote work-from-home culture, invest in employee growth, and strive for innovation to break through technology and government barriers.
Lead cybersecurity governance, assessment, and audit activities supporting a federal customer.
Coordinate evidence, control assessments, and remediation across NIST, RMF, and federal compliance requirements.
Maintain quality control, configuration traceability, and readiness for IV&V, QA, and government surveillance.
SkyePoint Decisions is a cybersecurity architecture, engineering, and IT services provider supporting federal government clients. Headquartered in Dulles, Virginia, it is an ISO-certified small business with a collaborative culture focused on mission assurance.
Serve as Compliance Officer and HIPAA Security Officer, leading compliance and information security programs.
Own HIPAA/HITECH compliance, SOC 2 Type II certifications, and policy framework governance.
Partner with Engineering, DevOps, Legal, and other functions to embed security and compliance into operations.
Prompt delivers highly automated modern software to rehab therapy businesses, revolutionizing healthcare technology. As one of the fastest-growing healthcare SaaS companies, it fosters an innovative, remote-friendly culture with a talented team.
Lead and oversee cybersecurity assessment and authorization activities for a major federal program.
Serve as the primary interface with government leadership and stakeholders.
Manage task order execution, staffing, schedules, and contractual performance.
This company supports federal cybersecurity programs and manages contracts for government clients. It offers a remote work environment and emphasizes employee empowerment and accountability.
Lead the design, implementation, and maintenance of Hyland's enterprise ISO governance and certification program across multiple certifications, business units, and regions.
Drive strategic expansion of ISO scope, including advanced certifications like TISAX and C5, and establish governance models and control ownership across teams.
Measure and report ISO program health through metrics, dashboards, and reporting, while providing leadership and mentorship to compliance specialists.
Hyland is the pioneer of the Content Innovation Cloud, delivering enterprise intelligence through solutions that unlock actionable insights and drive automation. Trusted by thousands of organizations worldwide, including many Fortune 100 companies, Hyland has nearly 4,000 employees and fosters an employee-centric, inclusive culture.