ZipRecruiter

Log In

1

Security Compliance Jobs in Silver Spring, MD (NOW HIRING)

previous pagenext page

Showing results 21-40

All JobsSecurity Compliance JobsSecurity Compliance Jobs in Silver Spring, MD

Security Compliance information

See Silver Spring, MD salary details

$33.6K

$83.9K

$127.7K

How much do security compliance jobs pay per year?

As of Aug 18, 2026, the average yearly pay for security compliance in Silver Spring, MD is $83,884.00, according to ZipRecruiter salary data. Most workers in this role earn between $62,500.00 and $103,400.00 per year, depending on experience, location, and employer.

What is security compliance?

Security compliance refers to the process of ensuring that an organization follows established laws, regulations, and industry standards related to information security. This involves implementing policies, procedures, and controls to protect data and systems from threats and unauthorized access. Security compliance professionals help organizations identify relevant requirements, assess risks, and maintain documentation to demonstrate adherence. Common frameworks and regulations include GDPR, HIPAA, ISO 27001, and PCI DSS.

What are the key skills and qualifications needed to thrive as a security compliance professional?

To thrive as a Security Compliance professional, you need a strong understanding of information security principles, regulatory frameworks (such as GDPR, HIPAA, or PCI DSS), and risk management, often supported by a degree in cybersecurity or related fields. Familiarity with compliance management tools, audit software, and certifications like CISSP, CISA, or ISO 27001 is typically required. Attention to detail, analytical thinking, and effective communication are vital soft skills for interpreting regulations and collaborating with stakeholders. These abilities ensure organizations remain compliant with laws and standards, mitigating risks and protecting sensitive data.

How does a security compliance professional typically collaborate with other departments to ensure adherence to regulations?

Security Compliance professionals regularly work cross-functionally with IT, legal, HR, and operations teams to implement and monitor compliance with industry standards and regulations. They often lead or participate in risk assessments, develop and deliver training, and coordinate audit activities. Effective communication and relationship-building are key, as they must translate complex regulatory requirements into practical steps for diverse teams. This collaborative approach ensures that all departments understand their roles in maintaining a secure and compliant environment.

What is the difference between Security Compliance vs Security Analyst?

AspectSecurity ComplianceSecurity Analyst
CertificationsISO 27001, CISSP, CISACISSP, CEH, Security+
Work EnvironmentPolicy development, audits, regulatory adherenceMonitoring, threat analysis, incident response
Employer & Industry UsageOrganizations ensuring regulatory complianceOrganizations analyzing security threats and vulnerabilities

Security Compliance focuses on ensuring organizations meet security standards and regulations through policies and audits. Security Analysts actively monitor and respond to security threats. While both roles require security certifications, Compliance emphasizes policy adherence, whereas Analysts focus on threat detection and incident management.

How to become a security compliance officer?

To become a security compliance officer, candidates typically need a bachelor's degree in cybersecurity, information technology, or a related field. Relevant certifications such as Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM) can enhance prospects, along with experience in security policies, risk management, and regulatory standards like GDPR or HIPAA.

Is a career in security compliance worth it?

A career in security compliance is valuable as it involves ensuring organizations adhere to cybersecurity standards and regulations, which is critical in protecting data and systems. It often requires knowledge of frameworks like GDPR or HIPAA and certifications such as CISA or CISSP, with job stability and growth prospects in the cybersecurity field.

What are popular job titles related to Security Compliance jobs in Silver Spring, MD?

For Security Compliance jobs in Silver Spring, MD, the most frequently searched job titles are:

What job categories do people searching Security Compliance jobs in Silver Spring, MD look for?

The top searched job categories for Security Compliance jobs in Silver Spring, MD are:

What cities near Silver Spring, MD are hiring for Security Compliance jobs?

Cities near Silver Spring, MD with the most Security Compliance job openings:

Security Compliance jobs near you
Infographic showing various Security Compliance job openings in Silver Spring, MD as of August 2026, with employment types broken down into 1% As Needed, 87% Full Time, 9% Part Time, and 3% Contract. Highlights an 92% Physical, 3% Hybrid, and 5% Remote job distribution, with an average salary of $83,884 per year, or $40.3 per hour.

SECURITY & COMPLIANCE ENGINEER (SCE)

Zermount, Inc

Arlington, VA • On-site

Full-time

Re-posted 16 hours ago

Job description

ZERMOUNT POSITION DESCRIPTION (PD) SECURITY & COMPLIANCE ENGINEERING (SCE)
POSITION OVERVIEW
Zermount Inc. is seeking System Compliance Engineering (SCE) to support system risk analysis and ensure that federal information systems comply with Information Assurance and cybersecurity standards. The SCE ensures that federal information systems are secure in operation, not merely compliant with documentation. This role directly contributes to mission assurance by identifying, validating, and mitigating real-world cybersecurity risks across enterprise environments.
The SCE operates at the intersection of compliance, engineering, and mission operations, transforming federal mandates (e.g., NIST RMF, FISMA, EO 14028, OMB directives) into measurable, technically enforced security outcomes. Rather than relying solely on static assessments, the role requires continuous evaluation of the system's security posture by directly analyzing configurations, logs, architectures, and control implementations.
This position is designed for individuals with foundational technical expertise across multiple domains, including cloud platforms, network architecture, operating systems, identity systems, and databases. You must be able to independently assess systems, identify exploitable conditions, and validate whether implemented controls effectively reduce risk in real-world scenarios.
The role is a core component of Zermount's Modern GRC mindset, emphasizing:
  • Continuous monitoring of system compliance responsibilities
  • Real-time risk identification and prioritization
  • Direct integration with system teams to drive remediation
  • Elimination of "check-the-box" compliance practices

You will be responsible for producing decision-quality outputs that enable system owners, ISSOs, and leadership to make informed, risk-based decisions. This includes identifying control failures, recommending technically sound remediation strategies, and validating that corrective actions are effective and sustainable.
DUTIES & RESPONSIBILITIES
General Duties
  • Execute RMF lifecycle (Prepare-Monitor) while validating controls directly in operational environments
  • Identify and document real-time risks through analysis of logs, telemetry, configurations, and architecture
  • Validate implementation of security controls (STIGs, MFA, encryption, access control) using system-level evidence
  • Identify exploitable misconfigurations, weak trust boundaries, and gaps across cloud, network, OS, and database layers
  • Drive POA&M actions by prioritizing risk based on exploitability and mission impact, ensuring closure within defined timelines
  • Perform continuous monitoring (ISCM/CDM) with emphasis on actual system behavior vs. reported compliance
  • Translate NIST, EO 14028, OMB, and TIC 3.0 requirements into specific technical remediation actions
  • Validate remediation actions with repeatable verification methods (not documentation review)
  • Produce executive-quality outputs (risk findings, remediation plans, executive summaries)
  • Maintain system artifacts and documentation only as a byproduct of validated technical work

SUBJECT MATTER EXPERTISE (SME)
SME Area #1 - Primary Expertise: Technical Risk Validation (Modern GRC Execution)
Expert-level means:
  • Ability to independently assess systems using direct technical inspection techniques, leveraging logs, configs, architecture documents, etc.
  • Deep working knowledge of critical frameworks and directives such as:
    • NIST RMF (800-37, 800-53, etc.)
    • FISMA, EO 14028, OMB M-21-31 / M-22-09
    • FIPS 199/200
    • TIC 3.0 and Zero Trust principles (CISA ZT MM, NIST 800-207, etc.)
  • Ability to identify threat surfaces within specific systems, not just control gaps
  • Ability to convert compliance requirements into specific and actionable remediation actions that the system teams can be used to successfully remediate findings

Required Tools Experience:
  • Vulnerability scanning tools such as: Tenable, Qualys, CrowdStrike, etc.
  • Log analysis platforms such as: Splunk, Microsoft Sentinel, IBM QRadar, etc.
  • Configuration and system inspection tools such as: Ansible, Terraform, Puppet etc.
  • GRC platforms such as: Archer, ServiceNow, etc.

SME Area #2 - Secondary Expertise: Multi-Domain Technical Depth
You must have deep knowledge of one or more of the following technical domains and must demonstrate the ability to leverage this experience to inform and complete compliance-related tasks.
Technical Domains
  • Cloud: AWS/Azure (IAM, logging, network security, misconfigurations)
  • Network: Segmentation, firewalls, boundary protections, Zero Trust enforcement points
  • Systems: Windows/Linux hardening, identity systems (AD, MFA)
  • Databases/Data: Access control, encryption, auditing

QUALIFICATIONS
Minimum Requirements
  • 5+ years of cybersecurity experience supporting U.S. Government systems
  • 4+ years performing RMF, ISSO, Assessment, or GRC functions with direct technical validation responsibilities
  • Demonstrated hands-on experience in at least two technical domains (cloud, network, systems, or databases)
  • Proven ability to analyze:
    • System configurations, ATOs, and other supporting security documentation
    • Logs/telemetry
    • Architecture documentation and data flow diagrams

Preferred Qualifications
  • Experience implementing or assessing Zero Trust architectures
  • Experience with CDM, ISCM, and enterprise logging programs
  • Familiarity with threat-informed defense concepts
  • Experience in hybrid cloud environments

Competency
  • Technical risk identification and prioritization
  • Independent problem-solving in ambiguous environments
  • Ability to translate policy into technical action
  • Clear communication with both engineers and leadership

Education & Certifications
  • Bachelor of Science (B.S.) in Computer Science, IT, Cybersecurity, or a related field, and a minimum of 5 years of IT cybersecurity experience, including direct support for the US Government and 4 years acting as an ISSO, Assessor, Compliance, RMF, or GRC with a technical validation role.
  • Without a B.S. in a relevant field - A minimum of 10 years of IT Cybersecurity experience, including direct support for the US Government, and 4 years acting as an ISSO, Assessor, Compliance, RMF, or GRC with a technical validation role.
  • At least one of the following security certifications is required:
    • Certified Authorization Professional (CAP)
    • Certified Information Security Auditor (CISA)
    • Certified Information Security Manager (CISM)
    • Certified Information Systems Security Professional (CISSP), or Certified Chief Information Security Officer (CCISO)
    • Governance Risk & Compliance Certification (CGRC)
    • Or alternatively approved certifications

Clearance Level
Minimum of active Secret Clearance and ability to obtain and maintain DHS suitability
WORK LOCATION
  • The position is primarily remote - Continental U.S only
  • Primary location when on site: Arlington, VA, and Springfield, VA
  • Must be willing to travel - Not to exceed 10% of the time

HOURS OF OPERATION
  • 8:00 am EST - 4:30 pm EST
    • Times may fluctuate based on client and business requirements

REPORTING STRUCTURE
  • Reports To: Security Compliance Engineering Team Lead
  • Direct Reports: N/A

Apply