Associate, GovCloud Cybersecurity and Compliance

Known for being a great place to work and build a career, KPMG provides audit, tax and advisory services for organizations in today’s most important industries. Our growth is driven by delivering real results for our clients. It’s also enabled by our culture, which encourages individual development, embraces an inclusive environment, rewards innovative excellence and supports our communities. With qualities like those, it’s no wonder we’re consistently ranked among the best companies to work for by Fortune Magazine, Consulting Magazine, Seramount, Fair360 and others. If you’re as passionate about your future as we are, join our team.

KPMG is currently seeking an Associate, GovCloud Cybersecurity Operations & Compliance to join our Fed Advisory organization.

Responsibilities

Assist with Entra ID governance: access reviews, PIM role reviews, account lifecycle checks, and break-glass account audits, review Conditional Access, Intune compliance, and STIG baselines for drift against documented standards, assist with network boundary reviews, including NSG and firewall rules documentation and cleanup tracking and Monitor security alerts, document incidents, and maintain the incident response log and tabletop records

Support vulnerability management: triage scan results, track remediation SLAs, and report status, assist with maintaining Cybersecurity Maturity Model Certification (CMMC) Level 2 evidence against the 110 NIST SP 800-171 practices, including continuous controls monitoring of all 320 assessment objectives

Support updates to the System Security Plan, operational standards and procedures, and operational plans of actions, help run continuous monitoring and configuration drift checks, and track findings to closure

Draft and update operational standard and procedures, and standard operating procedures; prepare materials for internal and external assessments, participate in team meetings and training sessions to build knowledge of compliance practices and frameworks

Stay informed about basic developments in National Institute of Standards and Technology (NIST) & Cybersecurity Maturity Model Certification (CMMC) regulations and communicate relevant updates to the team

Assist with preparation for external assessments, supporting senior staff as needed, help develop and deliver compliance training and awareness materials for internal stakeholders and support continuous improvement efforts for technical safeguards, contributing to compliance maturity as directed

Act with integrity, professionalism, and personal responsibility in support of KPMG's respectful and courteous work environment

Qualifications

Minimum one year of recent experience in cybersecurity, IT audit, Governance, Risk, and Compliance (GRC), or IT operations

Bachelor’s degree in cybersecurity, information systems, computer science, or a related field, or equivalent military/professional experience

Working knowledge of National Institute of Standards and Technology (NIST SP 800-17)1 or NIST SP 800-53, and how security controls map to technical evidence, familiarity with Microsoft cloud administration: Entra ID, Intune, Defender, or Azure portal, strong written documentation skills; able to produce clean, assessor-ready evidence and procedures

Hands-on exposure to CMMC Level 2, the CMMC Assessment Process, or Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012

Experience in Azure Government or M365 GCC-High environments KQL or PowerShell for evidence queries and drift checks; exposure to vulnerability management (Tenable, Qualys, or Defender) and ServiceNow and Certifications (anyone): CMMC Registered Practitioner or CMMC Certified Professional (CCP), Security+, SC-900/SC-300/AZ-500, or CISSP Associate preferred

Knows 800-171 families; maps evidence with guidance, interprets objectives independently; drafts SSP narratives, Executes assigned evidence and review tasks, owns a control family or monitoring cadence end to end, navigates Entra/Intune/Azure portals; runs prepared queries, writes and tunes KQL/PowerShell checks Security+ or SC-900 in first 6 months and CMMC RP/CCP or AZ-500 in first 12 months

Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)

KPMG LLP and its affiliates and subsidiaries ("KPMG") is an equal opportunity employer. KPMG complies with all applicable federal, state, and local laws regarding recruitment and hiring. All qualified applicants are considered for employment without regard to race/ethnicity, color, creed, religion, age, sex/gender, national origin, ancestry, citizenship status, marital status, sexual orientation, gender identity or expression, disability, pregnancy, childbirth or other related condition, military/veteran status, genetic information, status as a victim of domestic violence or sexual abuse or any other legally protected status.

The attached link contains further information regarding the firm's compliance with federal, state, and local recruitment and hiring laws.

KPMG recruits on a rolling basis. Candidates are considered as they apply, until the opportunity is filled. Candidates are encouraged to apply expeditiously to any role(s) for which they are qualified that is also of interest to them.

Los Angeles County applicants: Material job duties for this position are listed above. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness, and safeguard business operations and company reputation.

Pursuant to the California Fair Chance Act, Los Angeles County Fair Chance Ordinance for Employers, Fair Chance Initiative for Hiring Ordinance, and San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.