Security Governance Risk & Compliance (GRC) Analyst

Security Governance Risk & Compliance (GRC) Analyst at Virtru

About the role Virtru is seeking a dedicated GRC Analyst to join our security team and help develop, implement, and maintain a robust security compliance program.

In this role, you will be responsible for ensuring that our organization meets a variety of industry standards and regulatory requirements, including Fed RAMP, SOC 2, PCI, HIPAA, and GDPR.

Your expertise will support our ongoing efforts to safeguard sensitive data, improve security controls, and demonstrate compliance to clients and regulators.

As part of our team, you will collaborate closely with technical and business stakeholders to translate complex security requirements into practical, automated solutions and processes.

Your work will be instrumental in maintaining Virtru's reputation as a leader in data protection and privacy, enabling us to grow confidently in a highly regulated environment.

• Key facts
• Location: Washington, DC
• Remote Engagement: Full-time
• Virtru's security compliance team is committed to fostering a proactive security culture, and this role offers an exciting opportunity to influence our security posture at a strategic level.

The position involves working on-site at our Washington, DC office, with the possibility of remote work arrangements.

You will be part of a dynamic team focused on integrating compliance into our operational workflows, automating evidence collection, and supporting continuous monitoring efforts.

This role is ideal for someone with a strong background in security frameworks, cloud technologies, and automation tools, who is eager to make a tangible impact on our security practices.

What you'll do

• Lead the management and implementation of control frameworks for cloud infrastructure and Saa S services, ensuring alignment with industry standards and best practices.
• Develop and maintain automated solutions for collecting and verifying compliance evidence across various cloud environments, endpoints, and internal systems.
• Conduct comprehensive risk assessments across different business units, identifying vulnerabilities, assessing their potential impact, and recommending appropriate mitigation strategies.
• Support incident response activities by providing detailed risk analysis, assisting in root cause analysis, and helping coordinate remediation efforts to address security incidents.
• Assist in designing and deploying automated controls to enhance risk mitigation efforts, reduce manual effort, and improve audit readiness.
• Work closely with teams responsible for CMMC certification, integrating certification requirements into ongoing compliance assessments and monitoring activities.
• Evaluate third-party vendors and service providers during onboarding and annual reviews to ensure they meet Virtru's security standards and compliance requirements.
• Collaborate with cross-functional teams to embed security and compliance considerations into product development, deployment, and operational processes.
• Provide guidance and training to internal teams on security controls, compliance requirements, and best practices to foster a security-aware culture.
• Maintain up-to-date knowledge of evolving security standards, regulations, and industry trends to ensure Virtru remains compliant and secure.
• Prepare documentation, reports, and audit evidence for internal reviews and external audits, ensuring completeness and accuracy.
• Contribute to the continuous improvement of security policies, procedures, and automation tools to streamline compliance workflows and reduce manual effort.
• Communicate complex security and compliance issues clearly to technical and non-technical stakeholders, facilitating informed decision-making.
• Participate in security incident investigations and post-incident reviews, providing insights into compliance and risk management.
• Support the development of security awareness programs and initiatives to promote a security-first mindset across the organization.

Requirements

• Minimum of 5 years of experience in information security, IT audit, IT risk management, or as a GRC analyst or engineer.
• Strong knowledge of compliance frameworks such as CMMC, NIST 800-53 & 800-171, Fed RAMP, SOC 2, PCI, HIPAA, GDPR, and other relevant privacy regulations.
• Technical proficiency with cloud platforms including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
• Hands-on experience with GRC tools such as Hyperproof, Vanta, and Drata, as well as familiarity with SIEM tools like Datadog and Splunk.
• Proven ability to build and maintain relationships across technical teams, business units, and external vendors, translating risk and compliance requirements into actionable insights.
• Experience in designing and implementing automated compliance evidence collection and monitoring solutions.
• Strong analytical skills, with the ability to assess complex security controls and identify gaps or deficiencies.
• Excellent communication skills, capable of explaining technical security concepts to non-technical stakeholders.
• Ability to work independently and proactively in an agile environment, managing multiple priorities and deadlines.
• Demonstrated problem-solving skills and the capacity to handle conflicts or challenges effectively.
• Experience supporting or leading security audits and assessments, with a focus on continuous improvement.
• Familiarity with security incident response processes and risk mitigation strategies.
• A proactive attitude and enthusiasm for learning new security technologies and standards.
• Nice to have
• Experience working in a federal government contracting environment or supporting compliance with government standards.
• Knowledge of additional security standards such as ISO 27001, CIS Controls, or NIST Cybersecurity Framework.
• Familiarity with scripting or automation languages like Python, Power Shell, or Bash to support automation initiatives.
• Prior experience working with security teams in a Saa S or cloud-native environment.
• Understanding of data privacy laws and their impact on security practices.
• Certification such as CISSP, CISA, CISM, or Security+ is a plus.

Skills & tools

• Cloud platforms: AWS, GCP, Azure
• GRC tools: Hyperproof, Vanta, Drata
• SIEM tools: Datadog, Splunk
• Compliance frameworks: CMMC, NIST 800-53 & 800-171, Fed RAMP, SOC 2, PCI, HIPAA, GDPR
• Practical notes

Compensation for this role ranges from $130,000 to $170,000 annually, commensurate with experience and skills.

Virtru is committed to fostering a diverse and inclusive workplace, welcoming applicants from all backgrounds.

We are an Equal Opportunity Employer and do not discriminate based on race, color, gender, religion, disability, national origin, protected veteran status, age, or any other protected characterics.

This position involves working on-site at our Washington, DC office, with the possibility of remote work arrangements.

The role offers an excellent opportunity to develop expertise in security compliance, automation, and risk management within a fast-growing company dedicated to data privacy and security.

#J-18808-Ljbffr