GRC Analyst

• Support the ongoing development and administration of the organization's GRC program
• Maintain compliance with NIST SP 800-53, CJIS Security Policy, SOC 2, and Gov RAMP requirements
• Maintain the enterprise risk register and assist with periodic risk assessments
• Monitor control performance and identify remediation or improvement areas
• Develop, update, organize, and maintain security and compliance policies and procedures
• Manage policy version control, approvals, annual reviews, and employee attestations
• Support SOC 2 and Gov RAMP audit and authorization activities
• Assist with gap assessments and track remediation efforts through completion
• Collect, organize, validate, and maintain audit evidence
• Work with engineering and technical teams to complete compliance-related requirements
• Act as a primary contact for customer security questionnaires, vendor assessments, and compliance reviews
• Maintain approved questionnaire responses, supporting documentation, and customer-facing security materials
• Monitor contractual security, privacy, compliance, reporting, and service obligations
• Maintain a calendar of recurring contractual deliverables and deadlines
• Coordinate reports, SLA documentation, insurance certificates, certifications, and other required compliance materials
• Partner with the Growth team on government and public-sector RFPs, solicitations, and proposal opportunities
• Develop and edit security, technical, compliance, and management proposal sections
• Support proposal amendments, customer questions, formal responses, and post-award activities
• Create reusable proposal content and translate technical security capabilities for procurement and government stakeholders

Requirements

• 3–5+ years of experience in GRC, security compliance, information security, internal audit, or a related discipline
• Experience in a federal, regulated, or cloud-based technology environment
• Hands‑on participation in at least one complete audit or authorization cycle involving SOC 2, Fed RAMP, State RAMP/Gov RAMP, ISO 27001, CMMC, or a comparable framework
• Working knowledge of NIST SP 800‑53, SOC 2, and Gov RAMP requirements
• Technical understanding of cloud and/or on‑premises environments
• Knowledge of identity and access management, encryption, security logging and monitoring, network architecture, software development lifecycle, and change management
• Practical experience using AI tools for research, drafting, documentation, analysis, or evidence management
• Strong cross‑functional written and verbal communication skills
• Evidence‑first mindset and ability to identify, collect, organize, and validate control evidence
• Ability to create scalable workflows where processes are evolving
• Organization and execution skills to manage multiple priorities, stakeholders, and deadlines
• Strategic thinking combined with hands‑on execution skills
• Adaptability, independent problem‑solving, and ownership
• Demonstrated ability to coordinate concurrent initiatives while meeting firm external deadlines
• Ability to work independently and establish processes without extensive direction
• Must live in the United States
• Must be a US Citizen or Green Card Holder
• Must be able to work without sponsorship
• Preferred: experience with CJIS Security Policy, FBI NGI, or criminal justice information systems
• Preferred: experience supporting government or public‑sector RFPs and proposal development
• Preferred: familiarity with Vanta, Drata, or similar compliance automation platforms
• Preferred: experience working directly with government agencies or organizations subject to federal security requirements
• Core Competencies

Demonstrates expertise in GRC program development and administration, with a strong focus on compliance with NIST SP 800-53, SOC 2, and Gov RAMP requirements.

Proven ability to manage audits, develop security policies, and coordinate compliance-related initiatives in federal and regulated environments.

#J-18808-Ljbffr