Known for being a great place to work and build a career, KPMG provides audit, tax and advisory services for organizations in today's most important industries. Our growth is driven by delivering real results for our clients. It's also enabled by our culture, which encourages individual development, embraces an inclusive environment, rewards innovative excellence and supports our communities. With qualities like those, it's no wonder we're consistently ranked among the best companies to work for by Fortune Magazine, Consulting Magazine, Seramount, Fair360 and others. If you're as passionate about your future as we are, join our team. KPMG is currently seeking an Associate, GovCloud Cybersecurity Operations & Compliance to join our Fed Advisory organization.
Responsibilities:
- Assist with Entra ID governance: access reviews, PIM role reviews, account lifecycle checks, and break-glass account audits, review Conditional Access, Intune compliance, and STIG baselines for drift against documented standards, assist with network boundary reviews, including NSG and firewall rules documentation and cleanup tracking and Monitor security alerts, document incidents, and maintain the incident response log and tabletop records
- Support vulnerability management: triage scan results, track remediation SLAs, and report status, assist with maintaining Cybersecurity Maturity Model Certification (CMMC) Level 2 evidence against the 110 NIST SP 800-171 practices, including continuous controls monitoring of all 320 assessment objectives
- Support updates to the System Security Plan, operational standards and procedures, and operational plans of actions, help run continuous monitoring and configuration drift checks, and track findings to closure
- Draft and update operational standard and procedures, and standard operating procedures; prepare materials for internal and external assessments, participate in team meetings and training sessions to build knowledge of compliance practices and frameworks
- Stay informed about basic developments in National Institute of Standards and Technology (NIST) & Cybersecurity Maturity Model Certification (CMMC) regulations and communicate relevant updates to the team
- Assist with preparation for external assessments, supporting senior staff as needed, help develop and deliver compliance training and awareness materials for internal stakeholders and support continuous improvement efforts for technical safeguards, contributing to compliance maturity as directed
- Act with integrity, professionalism, and personal responsibility in support of KPMG's respectful and courteous work environment
Qualifications:
- Minimum one year of recent experience in cybersecurity, IT audit, Governance, Risk, and Compliance (GRC), or IT operations
- Bachelor's degree in cybersecurity, information systems, computer science, or a related field, or equivalent military/professional experience
- Working knowledge of National Institute of Standards and Technology (NIST SP 800-17)1 or NIST SP 800-53, and how security controls map to technical evidence, familiarity with Microsoft cloud administration: Entra ID, Intune, Defender, or Azure portal, strong written documentation skills; able to produce clean, assessor-ready evidence and procedures
- Hands-on exposure to CMMC Level 2, the CMMC Assessment Process, or Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012
- Experience in Azure Government or M365 GCC-High environments KQL or PowerShell for evidence queries and drift checks; exposure to vulnerability management (Tenable, Qualys, or Defender) and ServiceNow and Certifications (anyone): CMMC Registered Practitioner or CMMC Certified Professional (CCP), Security+, SC-900/SC-300/AZ-500, or CISSP Associate preferred
- Knows 800-171 families; maps evidence with guidance, interprets objectives independently; drafts SSP narratives, Executes assigned evidence and review tasks, owns a control family or monitoring cadence end to end, navigates Entra/Intune/Azure portals; runs prepared queries, writes and tunes KQL/PowerShell checks Security+ or SC-900 in first 6 months and CMMC RP/CCP or AZ-500 in first 12 months
- Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa) KPMG LLP and its affiliates and subsidiaries (“KPMG”) complies with all local/state regulations regarding displaying salary ranges. If required, the ranges displayed below or via the URL below are specifically for those potential hires who will work in the location(s) listed. Any offered salary is determined based on relevant factors such as applicant's skills, job responsibilities, prior relevant experience, certain degrees and certifications and market considerations. In addition, KPMG LLP is proud to offer a comprehensive, competitive benefits package, with options designed to help you make the best decisions for yourself, your family, and your lifestyle. Available benefits are based on eligibility. Depending on job classification, standard work hours, and years of service, KPMG LLP provides a Total Rewards Package that includes 401(k) and medical and may include dental, vision, disability and life insurance, personal well-being and Personal Time Off. Additionally, each year KPMG publishes a calendar of holidays to be observed during the year depending on your job classification and entity affiliation. Additional details about our benefits can be found towards the bottom of our KPMG US Careers site at Benefits & How We Work.
Follow this link to obtain salary ranges by city outside of CA:
https://kpmg.com/us/en/how-we-work/pay-transparency.html/?id=7481_9_26 KPMG LLP and its affiliates and subsidiaries ("KPMG") is an equal opportunity employer. KPMG complies with all applicable federal, state, and local laws regarding recruitment and hiring. All qualified applicants are considered for employment without regard to race/ethnicity, color, creed, religion, age, sex/gender, national origin, ancestry, citizenship status, marital status, sexual orientation, gender identity or expression, disability, pregnancy, childbirth or other related condition, military/veteran status, genetic information, status as a victim of domestic violence or sexual abuse or any other legally protected status. The attached link contains further information regarding the firm's compliance with federal, state, and local recruitment and hiring laws. KPMG recruits on a rolling basis. Candidates are considered as they apply, until the opportunity is filled. Candidates are encouraged to apply expeditiously to any role(s) for which they are qualified that is also of interest to them. Los Angeles County applicants: Material job duties for this position are listed above. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness, and safeguard business operations and company reputation. Pursuant to the California Fair Chance Act, Los Angeles County Fair Chance Ordinance for Employers, Fair Chance Initiative for Hiring Ordinance, and San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.