Associate, GovCloud Cybersecurity and Compliance

Known for being a great place to work and build a career, KPMG provides audit, tax and advisory services for organizations in today's most important industries. Our growth is driven by delivering real results for our clients. It's also enabled by our culture, which encourages individual development, embraces an inclusive environment, rewards innovative excellence and supports our communities. With qualities like those, it's no wonder we're consistently ranked among the best companies to work for by Fortune Magazine, Consulting Magazine, Seramount, Fair360 and others. If you're as passionate about your future as we are, join our team.

KPMG is currently seeking an Associate, GovCloud Cybersecurity Operations & Compliance to join our Fed Advisory organization.

Responsibilities:

• Assist with Entra ID governance: access reviews, PIM role reviews, account lifecycle checks, and break-glass account audits, review Conditional Access, Intune compliance, and STIG baselines for drift against documented standards, assist with network boundary reviews, including NSG and firewall rules documentation and cleanup tracking and Monitor security alerts, document incidents, and maintain the incident response log and tabletop records
• Support vulnerability management: triage scan results, track remediation SLAs, and report status, assist with maintaining Cybersecurity Maturity Model Certification (CMMC) Level 2 evidence against the 110 NIST SP 800-171 practices, including continuous controls monitoring of all 320 assessment objectives
• Support updates to the System Security Plan, operational standards and procedures, and operational plans of actions, help run continuous monitoring and configuration drift checks, and track findings to closure
• Draft and update operational standard and procedures, and standard operating procedures; prepare materials for internal and external assessments, participate in team meetings and training sessions to build knowledge of compliance practices and frameworks
• Stay informed about basic developments in National Institute of Standards and Technology (NIST) & Cybersecurity Maturity Model Certification (CMMC) regulations and communicate relevant updates to the team
• Assist with preparation for external assessments, supporting senior staff as needed, help develop and deliver compliance training and awareness materials for internal stakeholders and support continuous improvement efforts for technical safeguards, contributing to compliance maturity as directed
• Act with integrity, professionalism, and personal responsibility in support of KPMG's respectful and courteous work environment

Qualifications:

• Minimum one year of recent experience in cybersecurity, IT audit, Governance, Risk, and Compliance (GRC), or IT operations
• Bachelor's degree in cybersecurity, information systems, computer science, or a related field, or equivalent military/professional experience
• Working knowledge of National Institute of Standards and Technology (NIST SP 800-17)1 or NIST SP 800-53, and how security controls map to technical evidence, familiarity with Microsoft cloud administration: Entra ID, Intune, Defender, or Azure portal, strong written documentation skills; able to produce clean, assessor-ready evidence and procedures
• Hands-on exposure to CMMC Level 2, the CMMC Assessment Process, or Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012
• Experience in Azure Government or M365 GCC-High environments KQL or PowerShell for evidence queries and drift checks; exposure to vulnerability management (Tenable, Qualys, or Defender) and ServiceNow and Certifications (anyone): CMMC Registered Practitioner or CMMC Certified Professional (CCP), Security+, SC-900/SC-300/AZ-500, or CISSP Associate preferred
• Knows 800-171 families; maps evidence with guidance, interprets objectives independently; drafts SSP narratives, Executes assigned evidence and review tasks, owns a control family or monitoring cadence end to end, navigates Entra/Intune/Azure portals; runs prepared queries, writes and tunes KQL/PowerShell checks Security+ or SC-900 in first 6 months and CMMC RP/CCP or AZ-500 in first 12 months
• Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)