Governance, Risk, and Compliance (GRC) Analyst

Job Responsibilities:

• Policy Development & Oversight:

  Develop and maintain information security policies aligned with organizational goals and regulatory frameworks. Coordinate annual reviews and obtain executive approval to ensure policies remain relevant across domains such as access control and secure software development.

• Workflow Optimization:

  Design and implement repeatable IT Service Management (ITSM) workflows and runbooks to enhance operational efficiency and cross-functional alignment.

• Risk Assessment & Management:

  Conduct scheduled vulnerability scans and comprehensive enterprise risk assessments. Leverage AI-driven tools for automated documentation retrieval and issue tracking to support rapid response and proactive risk mitigation.

• Quantitative Risk Modeling:

  Utilize the FAIR (Factor Analysis of Information Risk) model to perform in-depth quantitative risk assessments. Collaborate with managed advisory services to address complex governance and compliance challenges.

• Regulatory & Standards Compliance:

  Ensure ongoing adherence to industry frameworks including the

  NIST Cybersecurity Framework

  and

  CIS Controls

  . Implement best practices across data encryption, business continuity, and disaster recovery planning.

• Performance Monitoring & Improvement: Develop service

  -management metrics and continual improvement roadmaps. Establish robust processes for production testing, release management, and lifecycle compliance.

• Governance Advisory:

  Advise on and implement frameworks to strengthen corporate governance and provide effective compliance oversight across business units.

Job Requirements:

• Minimum

  10 years of experience

  in Governance, Risk, and Compliance roles
• Proven expertise in

  policy development

  ,

  control mapping

  , and executive communication
• Strong cross-functional experience, especially with

  cybersecurity

  ,

  automation

  , and

  cloud environments

• Demonstrated success in leading

  vulnerability scanning

  and

  enterprise risk assessments

• Deep understanding of

  FAIR risk management

  methodologies
• In-depth knowledge of

  NIST CSF

  and

  CIS standards

• Hands-on experience with

  data encryption

  ,

  business continuity planning

  , and

  disaster recovery

• Proficiency in designing

  service-management metrics

  ,

  improvement roadmaps

  , and

  production/release processes

• Excellent written and verbal communication skills with the ability to engage stakeholders at all organizational levels

• Time Zone Support: US Eastern Time (ET) (Non-rotational)