Associate, GovCloud Cybersecurity and Compliance

About the Role

KPMG is seeking an Associate, GovCloud Cybersecurity Operations & Compliance to join their Fed Advisory organization.

Key Responsibilities

• Assist with Entra ID governance, including access reviews, PIM role reviews, account lifecycle checks, and break-glass account audits.
• Review Conditional Access, Intune compliance, and STIG baselines for drift against documented standards.
• Assist with network boundary reviews, including NSG and firewall rules documentation and cleanup tracking.
• Monitor security alerts, document incidents, and maintain the incident response log and tabletop records.
• Support vulnerability management: triage scan results, track remediation SLAs, and report status.
• Assist with maintaining Cybersecurity Maturity Model Certification (CMMC) Level 2 evidence against the 110 NIST SP 800-171 practices, including continuous controls monitoring of all 320 assessment objectives.
• Support updates to the System Security Plan, operational standards and procedures, and operational plans of actions.
• Help run continuous monitoring and configuration drift checks, and track findings to closure.
• Draft and update operational standards and procedures, and standard operating procedures.
• Prepare materials for internal and external assessments.
• Participate in team meetings and training sessions to build knowledge of compliance practices and frameworks.
• Stay informed about basic developments in National Institute of Standards and Technology (NIST) & Cybersecurity Maturity Model Certification (CMMC) regulations and communicate relevant updates to the team.
• Assist with preparation for external assessments, supporting senior staff as needed.
• Help develop and deliver compliance training and awareness materials for internal stakeholders.
• Support continuous improvement efforts for technical safeguards, contributing to compliance maturity as directed.
• Act with integrity, professionalism, and personal responsibility in support of KPMG's respectful and courteous work environment.

Requirements & Tech Stack

• Familiarity with Microsoft cloud administration: Entra ID, Intune, Defender, or Azure portal.
• Working knowledge of National Institute of Standards and Technology (NIST SP 800-171) or NIST SP 800-53, and how security controls map to technical evidence.
• Hands-on exposure to CMMC Level 2, the CMMC Assessment Process, or Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012.
• Experience in Azure Government or M365 GCC-High environments.
• Familiarity with KQL or PowerShell for evidence queries and drift checks.
• Exposure to vulnerability management tools like Tenable, Qualys, or Defender.
• Exposure to ServiceNow.
• Experience with 800-171 families: maps evidence with guidance, interprets objectives independently, drafts SSP narratives, executes assigned evidence and review tasks, owns a control family or monitoring cadence end to end, navigates Entra/Intune/Azure portals, runs prepared queries, writes and tunes KQL/PowerShell checks.

Qualifications

• Minimum one year of recent experience in cybersecurity, IT audit, Governance, Risk, and Compliance (GRC), or IT operations.
• Bachelor's degree in cybersecurity, information systems, computer science, or a related field, or equivalent military/professional experience.
• Strong written documentation skills; able to produce clean, assessor-ready evidence and procedures.
• Certifications (anyone): CMMC Registered Practitioner or CMMC Certified Professional (CCP), Security+, SC-900/SC-300/AZ-500, or CISSP Associate preferred.
• Note: Security+ or SC-900 required within the first 6 months. CMMC RP/CCP or AZ-500 required within the first 12 months.
• Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future.