grc analyst

Doppel Farmaceutici

<div><h2 class="jobSectionHeader"><b>The Role</b></h2>
<p>
At Doppel, we focus on building a culture where people feel respected, supported, and trusted to do meaningful work. We value clarity, collaboration, and solving real problems for our customers and teammates.</p>
<p>
We are looking for a Governance, Risk &amp; Compliance (GRC) Analyst to lead our certification and assurance programs&mdash;owning SOC 2 end‑to‑end and driving ISO 27001, ISO 27701, and ISO 42001 audit preparation and ongoing maintenance. You'll be the program lead partnering with Security, Engineering, IT, Legal, and Sales to keep controls effective, risks managed, and customer trust high.</p>
<p></p>
<h2 class="jobSectionHeader"><b>What You'll Do</b></h2>
<ul><li><b>Lead audits &amp; certifications</b>: Own preparation, execution, and ongoing maintenance for ISO 27001, ISO 27701, ISO 42001, and SOC 2, including gap analyses, remediation, evidence collection, auditor coordination, and management system documentation.</li>
<li><b>Manage enterprise risk</b>: Operate the security and enterprise risk program, maintain the risk register, perform system/vendor/AI risk assessments, and drive remediation and risk acceptance processes.</li>
<li><b>Ensure control effectiveness</b>: Design and execute control testing, track exceptions and corrective actions, and streamline compliance across frameworks (ISO, SOC 2, NIST, GDPR/CPRA, PCI, HIPAA/HITRUST).</li>
<li><b>Oversee access governance</b>: Lead periodic access reviews, enforce least-privilege and joiner/mover/leaver controls, and monitor privileged account usage.</li>
<li><b>Drive vendor &amp; third-party risk management</b>: Conduct due diligence, risk tiering, contract security/privacy requirements, and ongoing monitoring of critical suppliers and partners.</li>
<li><b>Support customer trust</b>: Own security and privacy questionnaires, RFP responses, and Trust Center content; engage with customers and sales teams to communicate our security posture.</li>
<li><b>Advance governance &amp; privacy</b>: Maintain the policy lifecycle, role-based training, and privacy processes.</li>
</ul><p></p><h2 class="jobSectionHeader"><b>What We're Looking For</b></h2>
<ul><li>5&ndash;7+ years in GRC, audit, or risk&mdash;at least 3+ years leading ISO 27001 certification/surveillance cycles and SOC 2 Type II audits; hands-on experience with ISO 27701 and ISO 42001 or equivalent AI governance programs.</li>
<li>Proven ownership of SOC 2 programs (scope, controls, evidence, auditor management) and continuous compliance in cloud‑first environments (AWS/Azure/GCP, SaaS).</li>
<li>Strong ability to communicate compliance jargon effectively across the business, tailoring complex requirements for technical, operational, and executive audiences.</li>
<li>Strong command of management systems (ISMS/PIMS/AIMS), Trust Services Criteria, control testing, sampling, and evidence sufficiency.</li>
<li>Practical experience running access certifications, vendor risk reviews, and customer security questionnaires/RFPs at scale.</li>
</ul><p></p><h2 class="jobSectionHeader"><b>Why Join Doppel</b></h2>
<ul><li>$120,000 - $140,000 USD</li>
<li>Meaningful equity so you share in Doppel's success</li>
<li>Remote first culture with flexibility built in</li>
<li>Flexible PTO, comprehensive health benefits, parental leave, and more</li>
<li>A high growth environment where your work has immediate impact and visibility</li></ul></div>

GRC Analyst

Contour Software

<div><div>About Contour</div><div></div><div><div>
Contour Software</div> has grown from a dozen people to over 2,000 staff across 3 cities, in less than 14 years.</div><div><br>
As a subsidiary of Constellation Software Inc., we are proud to be part of a global enterprise software conglomerate that has grown to become one of the top 10 software companies in the world, with employees and customers in 100+ countries. With a broad-based and ever-growing portfolio of market-leading, vertical-market enterprise solutions covering more than 100 industry domains in predominantly mature markets, CSI's recipe creates the perfect environment for professionals to build fulfilling, long-term careers.</div><div><br>
What started as an R&amp;D &amp; Accounting back-office, has progressed into a full-service Global Centre serving all functions and departments, at the divisional as well as operating group/corporate level. Today Contour employees, located in Karachi, Lahore &amp; Islamabad, are serving CSI divisions located in time zones spanning the globe, from Sydney to Vancouver. With the global growth of Constellation as the wind in our sails, we are only just getting started!</div><div></div><div><div><div>
The Division:<br>
<div>FOG Software Group</div> - a division of Vela Software Group part of Constellation Software Inc. - specializes in complete ERP solutions for manufacturers and distributors of make-to-order and engineer-to-order products in the building products, capital equipment, and automotive sectors. FOG also includes a complementary portfolio of software solutions for transportation management, material optimization, supply-chain management, multi-channel merchant, and direct-to-consumer distribution.<br>
<br>
The Position:<br>
As GRC Analyst for the FOG Software group , you will support certain companies within the FOG Software operating group to meet the regulatory and compliance requirements specifically PCI DSS as well support in meeting the Vela compliance requirements by working with specific business units IT, customer support, development teams as well as Vela GRC. We are looking for individuals who move fast, can break down and solve complex problems, and have strong ethical values.<br>
The hired candidate will be located and work out of the Contour Software Islamabad/Karachi/Lahore office, working as part of the resource-center, as an extension of the division-based G&amp;A department.<br>
<br>
Responsibilities:</div></div><div><div>
Document and implement information security policies and standards (related to PCI-DSS and NIST CSF compliance requirements) specific to certain business units.</div></div><div><div>
Lead the PCI-DSS compliance initiatives, monitor, and report the gaps in compliance to management.</div></div><div><div>
Review information systems, IT and SSDLC practices to ensure compliance with business unit's GDPR/ISO/PCI-DSS requirements as well as Vela security framework requirements including processes, standards, policies, and procedures.</div></div><div><div>
Conduct risk assessments to identify potential risk events and assist with quantifying their probability of occurrence and impact on the business and work with risk owners in mitigating those risks.</div></div><div><div>
Collaborate IT TechOps and security team to monitor risks and compliance status, report and develop countermeasures and contingency plans.</div></div><div><div>
Monitor the security logs of anti-virus and SIEM/IDS to verify that all systems are up-to-date and all incidents are being logged, monitored and timely responded to as per policy requirements.</div></div><div><div>
Monitor and evaluate security measures in collaboration with the IT TechOp team to protect against reasonably anticipated threats or hazards to the privacy, security, or integrity of protected information (PII, PCI).</div></div><div><div>
Manage external audits and assessments, oversee audit findings and management actions plans. Ensure corrective actions are taken. Work with risk owners in developing risk treatment plans, time estimations, follow-up and report status on action plans.</div></div><div><div>
Perform tasks as set forth by the management team.</div></div><div><div>
Provide security awareness and compliance trainings to the IT team as well as end-users in line with the PCI-DSS requirements.</div></div></div><div><div><div><br>
<br>
Qualification(s):</div></div><div><div>
Bachelor's Degree in Information Technology or related technical field.</div></div><div><div>
Candidate should have a minimum of 3+ years either Information Security Risk or Cyber Security Risk experience.</div></div><div><div>
Must have knowledge of cloud-based environments (AWS, GCP, Azure, etc.) with cloud governance experience.</div></div><div><div>
Must have experience in working in e-commerce environments and PCI-DSS V3.2.1/4.0.</div></div><div><div>
Sound working knowledge of industry best practices (NIST, ISO, SANS, COBIT) and Legislative and Regulatory and Industry Compliance Requirements (PCI, CCPA, GDPR etc.).</div></div><div><div>
Clear understanding of SDLC process and how Security validation is tied to that.</div></div><div><div>
Must have exceptional written, verbal and presentation communication skills.</div></div><div><div>
Ability to facilitate cross-functional teams.</div></div><div><div>
Ability to translate business requirements into control objectives.</div></div></div><div><div><div>
Strong project management skills.</div></div><div><div><br>
<br>
Good to Have:</div></div><div><ul><li><div>
Experience with PCI-DSS v4.0</div></li></ul></div><div><ul><li><div>
Experience of GRC Tools (such as Service Now, RSA Archer, 6Clicks)</div></li></ul></div><div><div><br>
One or more of the following certifications:</div></div><div><ul><li><div>
ISO 27001 Lead auditor/Implementer</div></li></ul></div><div><ul><li><div>
CISM, CISA and/or CISSP</div></li></ul></div><div><ul><li><div>
CRISC</div></li></ul></div><div><div><br>
<br>
Work Shift Timings:</div></div><div><ul><li><div>
6:00 pm to 3:00 am (Pakistan Standard Time) &ndash; 7:00 am to 4:00 pm (Central Time Zone)</div></li></ul></div></div><div></div><div><br>
Exciting Benefits we offer:</div><ul><li><div>
Market-leading Salary</div></li><li><div>
Medical Coverage &ndash; Self &amp; Dependents</div></li><li><div>
Parents Medical Coverage</div></li><li><div>
Provident Fund</div></li><li><div>
Employee Performance-based bonuses</div></li><li><div>
Home Internet Subsidy</div></li><li><div>
Conveyance Allowance</div></li><li><div>
Profit Sharing Plan [Tenured Employees Only]</div></li><li><div>
Life Benefit</div></li><li><div>
Child Care Facility</div></li><li><div>
Company Provided Lunch/Dinner</div></li><li><div>
Professional Development Budget</div></li><li><div>
Recreational area for in-house games</div></li><li><div>
Sporadic On-shore training opportunities</div></li><li><div>
Friendly work environment</div></li><li><div>
Leave Encashment</div></li></ul><div></div><div><i>
Disclaimer:</i><i> At Contour, we attribute our success to the unique contributions of our diverse staff. We&rsquo;re committed to fostering a culture of respect that thrives on the varied perspectives and experiences of all individuals we recruit, employ, promote, and compensate. Since day one, we&rsquo;ve adhered to a policy that champions a work environment honoring the worth and dignity of each person while being free from all forms of employment discrimination.</i></div><div></div><div><i>
In our continuous effort to promote inclusivity, we extend our commitment to individuals with special needs by providing reasonable accommodations. We actively encourage qualified individuals with special needs to apply for the various openings within our company. Should you require assistance in completing the application process or have any inquiries regarding special facilities, please do not hesitate to contact our HR team. Your unique talents and abilities are welcomed and valued here.</i></div></div><div></div>

Sargent & Lundy

<div>Description:
<div>
Sargent &amp; Lundy is a leading consulting engineering firm specializing in the power and energy sectors. Since 1891, we have provided comprehensive engineering, design, and consulting services for both traditional and renewable power generation, grid modernization, nuclear power, and beyond. Our mission is to help clients achieve their energy goals effectively by leveraging advanced technologies and adopting sustainable practices.</div><h4 class="jobSectionHeader"><b>
Role Overview</b></h4><div>
Sargent &amp; Lundy is seeking a proactive, data-driven, and detail-oriented Senior GRC Analyst to lead key pillars of Governance, Risk, and Compliance (GRC) with a primary emphasis on enterprise Information Security, TPRM, contract governance, and cross-functional coordination with Legal and Procurement. You will own cyber training, communications, and phishing simulations, and drive measurable outcomes through strong data analysis and dashboard reporting (KPIs/KRIs). You will support audit readiness and regulatory alignment across frameworks such as ISO 27001, SOC 2, NIST CSF/171, and CMMC. You will also guide privacy-aligned practices (e.g., GDPR) and lead effective policy implementation through clear procedures, controls, and adoption plans.</div><p><b>
Essential Responsibilities</b></p><ul><li>
Lead and mature the Third-Party Risk Management (TPRM) program: Develop &amp; manage vendors inventory, conduct risk reviews of third-party vendors, define tiering/scoping, evaluate controls, track obligations/findings through closure, and standardize evidence retention in collaboration with Legal and Procurement.</li><li>
Drive strong contract management with Legal and Procurement: Standardize security and privacy clauses, review S&amp;L client contracts, negotiate requirements, and ensure obligations are tracked, owned, and reported.</li><li>
Own the security awareness &amp; training program end-to-end: Develop curriculum, coordinate communications, execute phishing simulations, analyze outcomes, and improve effectiveness using KPI/KRI dashboards and trend reporting.</li><li>
Administer and optimize GRC platforms and workflows (e.g., Hyperproof) to maintain visibility into risks, assessments, findings, and audit deliverables; establish SLAs and performance indicators.</li><li>
Develop risk management &amp; risk assessment practice, conduct risk assessments, develop and manage risk register with clear tracking of risks and accountability.</li><li>
Advance security governance by drafting, maintaining, and operationalizing policies, standards, procedures, and roles &amp; responsibilities; lead change management and communications to ensure policy implementation and adoption.</li><li>
Coordinate evidence and execute control readiness for ISO 27001, SOC 2, NIST CSF, CMMC (gap analysis, control testing, POA&amp;Ms), and support automation that reduces workload.</li><li>
Support privacy-aligned practices (e.g., GDPR): contribute to data classification/handling standards, data mapping/records of processing, privacy-by-design reviews, incident/breach alignment, and retention practices.</li><li>
Oversee governance for Business Continuity and Disaster Recovery and Backup &amp; Recovery in partnership with IT (plan maintenance, exercises, lessons learned, reporting).</li><li>
Lead cross-functional coordination with IT, HR, Finance, Legal, and business teams to embed compliance into operations and accelerate remediation of findings.</li><li>
 Manage security tasks/projects and report progress via standardized dashboards, scorecards, and executive-ready narratives, highlighting risk, performance, and trends. - Define, publish, and automate metrics &amp; management reporting (KPIs/KRIs) for training effectiveness, phishing trends, vendor risk, audit readiness, privacy/policy adoption, and control performance.</li><li>
Continuously upgrade information security skills, contribute to Information Security team skill development with playbooks, enablement sessions, and knowledge-sharing.</li><li>
 Support government contract compliance reviews and tracking, ensuring obligations are documented, monitored, and evidenced.</li></ul><div></div><div><b><br>
Core Areas of Responsibility (Scope)</b></div><br>
<div></div><ul><li>
 Information Security Governance, Policies, Standards, Procedures, and Roles &amp; Responsibilities.</li><li>
 Risk Management &ndash; Information security risk management and risk assessments</li><li>
Compliance management &ndash; Audit evidence management, audit coordination and compliance monitoring</li><li>
Third Party Risk Management - Third Party Risk Management, Vendor Assessments, Client Contract Reviews and obligation management.</li><li>
Security Awareness &amp; Training &mdash; including communications and phishing simulations: Hoxhunt and Mimecast</li><li>
 Coordination with IT, HR, Finance, Legal, and Business Teams. - Security Tasks/Projects Management.</li><li>
Metrics &amp; Management Reporting &mdash; strong emphasis on data analysis and dashboarding. Information Security Team Skill Development.</li><li>
Government Contract Compliance Reviews and Tracking.</li><li>
Deep Knowledge of Governance &amp; Privacy</li><li>
Policy lifecycle management and control mapping; demonstrated ability to translate policy into procedures/controls and drive organization-wide policy implementation and adoption.</li><li>
Privacy principles and GDPR-aligned practices (e.g., data classification/handling, data mapping/records of processing, privacy by design, incident/breach communications aligned to policy).</li><li>
 Compliance standards and frameworks (ISO 27001, NIST CSF, SOC 2, CMMC).</li><li>
 Third-party risk, software intake governance, audit readiness, and evidence management.</li><li>
Security &amp; TPRM Tools - TPRM platforms: ProcessUnity (Vendor Risk, Contract/Obligations, Issues/Findings tracking). - TPRM intelligence/workflow: OneTrust, BitSight (as applicable).</li><li>
GRC/risk registers: Hyperproof (risk, controls, evidence, audits). - Data analytics and reporting: Power BI and Excel (for KPI/KRI dashboards and executive reporting).</li><li>
Business Continuity and Disaster Recovery Process Oversight. - Backup &amp; Recovery Process Oversight.</li><li>
Mentoring, cross functional team collaboration and executive reporting</li></ul><div></div><p><b><br>
This position offers the flexibility of a hybrid schedule with the expectation of 3 days per week in our downtown Chicago office, and 2 days remote from home.</b></p>
Qualifications:
<h1 class="jobSectionHeader"><b>Required Qualifications</b></h1><ul><li>
 Bachelor&rsquo;s degree in computer science, information systems, or related field; or equivalent professional experience.</li><li>
5+ years in GRC or related domains, including leadership/ownership of programs or workstreams.</li><li>
 Strong understanding of ISO 27001, SOC 2, NIST CSF; experience with CMMC readiness.</li><li>
Practical knowledge of privacy and GDPR with the ability to implement policy via procedures, controls, communications, and training.</li><li>
Proven expertise in risk management, compliance operations, policy/standards, vendor risk, resilience, security training/awareness, and audit readiness.</li><li>
Advanced data analysis skills with the ability to design and maintain KPI/KRI dashboards, translate data into insights, and present executive-ready reporting.</li><li>
Familiarity with security technologies across on-prem and cloud environments; strong problem-solving and systems thinking.</li><li>
Professional certifications (e.g., CISSP, CISM, CRISC) are advantageous.</li></ul><h1 class="jobSectionHeader"><b>
Soft Skills</b></h1><ul><li><b>
Compassionate </b><b>Candor</b>: Provide candid, actionable feedback to enhance team performance and individual growth.</li><li><b>
Seek</b><b> to Understand</b>: Embrace curiosity and a commitment to continuous learning, fostering an environment of collaboration and innovation.</li><li><b>
We Before Me</b>: Actively collaborate and engage diverse perspectives to ensure collective success.</li><li><b>
Do What You Say</b>: Take ownership of commitments, prioritizing and delivering on key initiatives.</li><li><b>
Light Up Learning</b>: Encourage bravery in trying new ideas, sharing failures as opportunities for growth and learning.</li><li><b>
Driven by Passion</b>: Connect personal passion to the mission, demonstrating resilience in the face of challenges while pursuing organizational goals.</li></ul><div></div><div><b><br>
Why Join Us?</b></div><ul><li>
Work in an established company that values innovation and growth.</li><li>
Engage with a collaborative team that is dedicated to making a meaningful impact in the energy sector.</li><li>
Gain exposure to cutting-edge projects and contribute to data-driven decision-making processes.</li></ul><div></div><p><b><br>
We do not sponsor employees for work authorization in the U.S. for this position.</b></p><br>
<p></p>
Award-Winning Benefits:
<p>
At Sargent &amp; Lundy, we care about the health and well-being of our employees. Our commitment extends beyond the workplace, offering comprehensive healthcare plans and generous paid time off to support our team members in every aspect of their lives. We understand the importance of work-life balance, which is why we are proud to provide competitive, award-winning benefits. Our dedication to employee satisfaction has earned us the prestigious Top Workplaces Culture Excellence Award for compensation and benefits in 2022, 2023, and 2024.</p><p></p><div><div><div><b><br>
Health &amp; Wellness</b></div><div><b> Financial Benefits</b></div><div><b> Work-Life Balance</b></div></div><br>
<div><ul><li>
Health Plans: Medical, Dental, Vision</li><li>
Life &amp; Accident Insurance</li><li>
Disability Coverage</li><li>
Employee Assistance Program (EAP)</li><li>
Back-Up Daycare</li><li>
FSA &amp; HSA</li></ul><ul><li>
401(k)</li><li>
Pre-Tax Commuter Account</li><li>
Merit Scholarship Program</li><li>
Employee Discount Program</li><li>
Corporate Charitable Giving Program</li><li>
Tuition Assistance</li><li>
First Professional Licensure Bonus</li><li>
Employee Referral Bonus</li></ul><ul><li>
Paid Annual Personal/Sick Time (PST)</li><li>
Paid Vacation</li><li>
Paid Holidays</li><li>
Paid Parental Leave</li><li>
Paid Bereavement Leave</li><li>
Flexible Work Arrangements</li></ul></div><br>
</div>
Compensation Range: $100,010.00 - $144,190.00 Transparency Statement: Sargent &amp; Lundy discloses compensation ranges that comply with all local and state regulations. The total compensation package for eligible positions will include a base salary or an hourly rate and a comprehensive benefits package, reflecting our commitment to rewarding performance and supporting the overall well-being of our employees. Individuals may also be eligible to participate in our yearly discretionary bonus. Awards &amp; Recognition:
<div></div>
Equal Opportunity:
<div>
Sargent &amp; Lundy is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, national origin, disability status, protected veteran status, or any protected status as defined by applicable law.</div></div>

Senior GRC Analyst

Tire Rack

<div><p><b>Sr. Information Security GRC Analyst</b></p>
<p><b>
Location:</b> Tire Rack &ndash; South Bend, IN (On-Site)<br>
<b>Department:</b> Information Security</p>
<p><b>
Employment Type:</b> Full-Time<br>
<b>Salary Range:</b> $115,000-$125,000 annually</p><br>
<p></p>
<p><b>
About the Role</b></p>
<p>
Tire Rack is seeking a Senior Information Security GRC Analyst to support and advance our Information Security Governance, Risk, and Compliance (GRC) program</p>
<p>
.</p>
<p>
In this role, you will assess and strengthen IT and security controls across the organization while ensuring alignment with regulatory, statutory, and industry security standards including ISO/IEC 27001:2022, PCI DSS, and internal security policies.</p><br>
<p></p>
<p>
This position works closely with IT teams, business leaders, and audit stakeholders to identify risk exposures, strengthen control frameworks, support audit readiness, and drive continuous improvement in Tire Rack&rsquo;s overall security posture.</p><br>
<p></p>
<p>
This role requires a strong mix of technical understanding, risk assessment expertise, and the ability to translate compliance requirements into practical, business-aligned security controls.</p><br>
<p></p>
<p>
At Tire Rack, we operate with the values of IOOGA &mdash; Integrity, Our People, Our Customers, Growth, and Attitude.</p><br>
<p></p>
<p><b>
What You'll Do</b></p><br>
<p></p>
<p><b>
Governance, Risk &amp; Compliance Leadership</b></p>
<ul><li>
Advise IT and business stakeholders on governance, risk, and compliance requirements by interpreting regulatory, statutory, and security standards and translating them into actionable control recommendations.</li><li>
Lead and support the organization&rsquo;s information security risk management program, including risk identification, assessment, documentation, and monitoring mitigation strategies.</li><li>
Evaluate technology risks and recommend practical mitigation strategies aligned with business objectives.</li></ul>
<p><b>
Controls &amp; Compliance</b></p>
<ul><li>
Develop and maintain GRC program documentation including:</li><li><ul><li>
Security policies</li><li>
Standards and procedures</li><li>
Risk registers</li><li>
Control inventories</li><li>
Evidence repositories</li></ul>
</li><li>Strengthen internal security controls by identifying opportunities to improve standardization, documentation, and compliance alignment.</li><li>
Define and communicate control expectations, testing procedures, and audit evidence requirements across teams.</li></ul>
<p><b>
Audit &amp; Testing</b></p>
<ul><li>
Coordinate internal and external audits, including planning, evidence collection, stakeholder coordination, and remediation tracking.</li><li>
Execute security control testing by:</li><li><ul><li>
Defining scope</li><li>
Reviewing and validating evidence</li><li>
Documenting results</li><li>
Identifying deficiencies</li><li>
Tracking remediation through resolution.</li></ul>
</li><li>Manage compliance findings, corrective actions, and risk acceptance documentation.</li></ul><br>
<p></p>
<p><b>
Program Improvement</b></p>
<ul><li>
Support security initiatives and technology projects by embedding governance, risk, and compliance practices into delivery.</li><li>
Track program metrics, audit results, and compliance trends to improve security maturity over time.</li><li>
Provide recommendations to strengthen Tire Rack&rsquo;s overall security and compliance framework.</li><li>
Perform other duties as assigned in support of the Information Security and Technology organization.</li></ul>
<p><b>
What We're Looking For</b></p>
<p>
We are looking for a security professional who brings both technical understanding and risk management expertise while partnering effectively across teams.</p><br>
<p></p>
<p><b>
Required Experience</b></p>
<ul><li>
5&ndash;7 years of experience in IT, cybersecurity, risk management, audit, or compliance roles.</li><li>
Strong knowledge of information security frameworks including:</li><li><ul><li>
ISO/IEC 27001</li><li>
PCI DSS</li><li>
Familiarity with GDPR concepts</li></ul>
</li><li>Understanding of IT environments, systems, and security controls across infrastructure, applications, and data environments.</li></ul>
<p><b>
Skills &amp; Competencies</b></p>
<ul><li>
Strong analytical and problem-solving abilities with the capacity to identify trends, patterns, and control risks.</li><li>
Ability to evaluate control design and operational effectiveness.</li><li>
Excellent documentation, organization, and attention to detail.</li><li>
Strong communication skills with the ability to explain complex technical or compliance concepts to both technical and non-technical audiences.</li><li>
Ability to work independently while collaborating effectively with cross-functional stakeholders.</li></ul>
<p><b>
Required Certifications (One or more)</b></p>
<p>
Candidates must possess one or more of the following professional certifications, or be able to obtain one within a reasonable period after hire:</p>
<ul><li>
CISA (Certified Information Systems Auditor)</li><li>
CRISC (Certified in Risk and Information Systems Control)</li><li>
CISSP (Certified Information Systems Security Professional)</li><li>
CISM (Certified Information Security Manager)</li><li>
CompTIA Security+</li></ul>
<p>
Equivalent or comparable information security, audit, risk, or compliance certifications may also be considered.</p><br>
<p></p>
<p><b>
Education</b></p>
<ul><li>
Bachelor&rsquo;s Degree in Information Systems, Information Technology, Cybersecurity, Risk Management, or a related field.</li></ul>
<p><b>
Work Schedule</b></p>
<p><b>
Work Days:</b><br>
Monday through Friday<br>
Occasional weekends may be required.</p>
<p><b>
Work Hours:</b><br>
8:00 a.m. &ndash; 5:00 p.m.<br>
Additional hours may be required depending on project or audit needs.</p><br>
<p></p>
<p>
#HP</p></div>

Sr. Information Security GRC Analyst

Motion Recruitment

<div>
 <p>
  Our client,
  <strong>
   a leader in banking &amp; financial services
  </strong>
  , is looking to hire an
  <strong>
   Information Security Analyst.
   <em>
    This role is hybrid onsite 3x per week in Chandler, AZ.
   </em>
  </strong>
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   <em>
    *This job is a 1-year W2 contract role with benefits!*
   </em>
  </strong>
 </p>
 <p>
  <br/>
 </p>
 <p>
  As an
  <strong>
   Information Security Analyst
  </strong>
  , you will be responsible for
  <strong>
   managing information security projects and applying hands-on security knowledge to enable secure financial operations
  </strong>
  . The team is looking for someone to
  <strong>
   <em>
    provide guidance and bring a well-rounded approach in information security, risk management, vulnerability management and detection, and governance, risk, and compliance.
   </em>
  </strong>
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   What You'll Be Doing:
  </strong>
 </p>
 <ul>
  <li>
   <strong>
    Monitor, analyze, and support resolution of cybersecurity risks, assessing for threats, identifying gaps, and recommending mitigation strategies
   </strong>
  </li>
  <li>
   <strong>
    Configure, maintain and optimize GRC platforms using IBM OpenPages
   </strong>
  </li>
  <li>
   Ensure appropriate
   <strong>
    handling of sensitive data types under NIST, ISO, CRI and OWASP information security standards/frameworks
   </strong>
  </li>
  <li>
   <strong>
    Coordinate and support GRC projects and controls implementation,
   </strong>
   including the
   <strong>
    preparation, tracking, and documentation of evidence to facilitate compliance audits
   </strong>
  </li>
  <li>
   <strong>
    Research, recommend, and implement procedures
   </strong>
   to
   <strong>
    enhance data systems security based on evolving federal and data privacy regulations
   </strong>
  </li>
  <li>
   <strong>
    Communicate with engineers, research teams, and administrators to understand their security need
   </strong>
   s, fostering understanding and
   <strong>
    adherence to necessary security procedures
   </strong>
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Required Skills &amp; Experience
  </strong>
 </p>
 <ul>
  <li>
   <strong>
    4+ years of experience
   </strong>
   in
   <strong>
    information security &amp; risk analysis
   </strong>
  </li>
  <li>
   <strong>
    Experience using GRC, IAM, and risk management tools
   </strong>
   for
   <strong>
    compliance automation and documentation
   </strong>
  </li>
  <li>
   Prior experience in
   <strong>
    highly regulated or financial environments such as NIST, ISO, CRI and OWASP security standards
   </strong>
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Desired Skills &amp; Experience
  </strong>
 </p>
 <ul>
  <li>
   <strong>
    Associate's or Bachelor's Degree in Business, Administration, Computer Science, Information Security, or related field
   </strong>
  </li>
  <li>
   <strong>
    Experience using IBM OpenPages and/or Gen AI tools (CoPilot, Wiz, etc.)
   </strong>
  </li>
  <li>
   <strong>
    Security+, AWS/GCP Cloud Security, CISA, CISM, or CISSP Associate Certifications
   </strong>
  </li>
  <li>
   <strong>
    <em>
     Prior experience in higher education or research-related industries highly valued!
    </em>
   </strong>
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <em>
   Motion Recruitment Partners is an Equal Opportunity Employer, including disability/vets. All applicants must be currently authorized to work on a full-time basis in the country for which they are applying, and no sponsorship is currently available. Employment is subject to the successful completion of a pre-employment screening. Accommodation will be provided in all parts of the hiring process as required under Motion Recruitment Employment Accommodation policy. Applicants need to make their needs known in advance.
  </em>
 </p>
</div>


Information Security Analyst

SSC HR Solutions

<div>
 <strong>
  Job Purpose:
  <br/>
  <br/>
 </strong>
 Support the implementation, monitoring, and continuous improvement of information security governance, risk management, and compliance program. This role contributes directly to maintaining ISO 27001:2022 certification, supporting surveillance and external audits, driving KPI/KRI reporting, and enabling the maturity and scalability of GRC processes.
 <br/>
 <br/>
 Job Responsibilities:
 <br/>
 <br/>
 &squf; Support the development, implementation, and enhancement of the Information Security Management System (ISMS) in line with ISO 27001:2022 .
 <br/>
 <br/>
 &squf; Assist in maintaining GRC policies, procedures, and standards aligned with regulatory and business requirements
 <br/>
 <br/>
 &squf; Gather and report on security-related KPIs and KRIs to monitor control effectiveness and program health
 <br/>
 <br/>
 &squf; Participate in risk assessments, maintain the risk register, and support mitigation tracking
 <br/>
 <br/>
 &squf; Contribute to internal and external audit readiness, including ISO surveillance visits
 <br/>
 <br/>
 &squf; Collaborate with internal stakeholders to promote security awareness and compliance culture
 <br/>
 <br/>
 &squf; Support the implementation and use of GRC platforms (e.g., ServiceNow GRC, Archer, OneTrust)
 <br/>
 <br/>
 &squf; Engage with ongoing projects to support secure development practices, compliance checks, and risk registers
 <br/>
 <br/>
 &squf; Prepare documentation and participate in quarterly ISMS and GRC reporting cycles
 <br/>
 <br/>
 &squf; Operates under the direction of the GRC Manager with a focus on execution and coordination, not strategic program ownership
 <br/>
 <br/>
 <strong>
  Job Skills and Abilities:
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Basic understanding of ISO 27001and risk frameworks
  </li>
  <li>
   Awareness of data protection laws
  </li>
  <li>
   Familiarity with risk management processes
  </li>
  <li>
   Clear communication and cross-functional collaboration
  </li>
  <li>
   Analytical and documentation skills
  </li>
  <li>
   Process-focused, detail-oriented mindset
  </li>
  <li>
   Ability to coordinate across departments on compliance topics
  </li>
  <li>
   Ability to manage multiple assignments under supervision
  </li>
  <li>
   Ability to collect and maintain reliable compliance data
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Requirements
  <br/>
  <br/>
 </strong>
 <strong>
  Qualifications
 </strong>
 :
 <br/>
 <br/>
 <ul>
  <li>
   Bachelor's degree in computer science engineering
  </li>
  <li>
   2-6 years of experience in information security, risk management, or GRC roles
  </li>
  <li>
   Exposure to ISO 27001
  </li>
  <li>
   Experience with GRC platforms (e.g., ServiceNow GRC, Archer, OneTrust) is a plus
  </li>
  <li>
   Certifications preferred: ISO/IEC 27001 Foundation or Implementer, CompTIA Security+, CISA, CRISC
  </li>
 </ul>
</div>


Information Security Governance Analyst

PingWind Inc.

<div><div><p><b>Location:</b> Alexandria, Va<br>
<b>Required Clearance:</b> Top secret Clearance<br>
<b>Certifications: </b>Holds senior-level cybersecurity and GRC certifications appropriate for RMF and compliance roles, such as CISSP, CAP, CISM, or equivalent DoD 8570/8140-approved cybersecurity certifications.<br>
<b>Required Education:</b> BS/BA degree<br>
<b>Required Experience: </b>10 years relevant experience (an additional 4 years experience may be substituted in lieu of degree).</p><p><br>
<b>
Position Description:</b></p>
<p>
PingWind is seeking a Cybersecurity Analyst responsible for leading governance, risk, and compliance (GRC) activities to ensure MODES III systems maintain continuous compliance with DoD cybersecurity requirements, security controls, and risk management standards.</p><p><br>
<b>
Responsibilities:</b></p>
<ul><li>Leads governance, risk, and compliance activities supporting MODES III cybersecurity operations, ensuring alignment with DoD, DISA, and MC&amp;FP cybersecurity requirements.</li><li>Oversees implementation, assessment, and continuous monitoring of security controls in accordance with the NIST Risk Management Framework (RMF).</li><li>Manages and supports vulnerability management activities using DISA ACAS, including review, analysis, prioritization, and tracking of findings through remediation. (DISA ACAS).</li><li>Develops, reviews, and maintains security documentation, including SSPs, POA&amp;Ms, risk assessments, and compliance artifacts.</li><li>Supports cybersecurity audits, inspections, and assessments by preparing evidence, responding to findings, and coordinating corrective actions.</li><li>Provides senior-level risk analysis and compliance reporting to Government stakeholders, ensuring visibility into security posture, risks, and mitigation status.</li></ul>
<p><b>
Required Qualifications</b></p>
<ul><li>Must hold or be able to obtain and maintain a Top Secret</li><li>Holds senior-level cybersecurity and GRC certifications appropriate for RMF and compliance roles, such as CISSP, CAP, CISM, or equivalent DoD 8570/8140-approved cybersecurity certifications.</li></ul><p><br>
<b>
Desired Qualifications</b></p>
<ul><li>Master&rsquo;s Degree</li></ul>
<p><b>
About PingWind</b></p>
<p>
PingWind is focused on delivering outstanding services to the federal government. We have extensive experience in the fields of cybersecurity, development, IT infrastructure, supply chain management and other professional services such as system design and continuous improvement. PingWind is an SBA certified Service-Disabled Veteran-Owned Small Business (SDVOSB) with offices in Northern Virginia and Huntsville AL.<br>
www.PingWind.com</p>
<p>
Our benefits include:</p>
<ul><li>Eleven Federal Holidays</li><li>Paid Time Off accrued each pay period</li><li>Parental Leave</li><li>Three medical plan choices with generous employer contribution</li><li>Dental and Vision Insurance</li><li>Company paid Short-Term and Long-Term Disability</li><li>Company paid Life and AD&amp;D Insurance</li><li>401k with competitive matching and vesting schedule</li><li>Continuing education assistance</li><li>Short Term / Long Term Disability &amp; Life Insurance</li><li>Medical, Dependent Care and Commuter Flexible Spending Accounts</li><li>Employee Assistance Program</li><li>Wellness benefits include Calm Health app and WellHub gym subsidy (formerly GymPass)</li><li>529 College Savings Plan</li><li>Legal Insurance</li><li>Pet Insurance</li></ul>
<p>
Veterans are encouraged to apply</p>
<p>
PingWind, Inc. does not discriminate in employment opportunities, terms, and conditions of employment, or practices on the basis of race, age, gender, religious or political beliefs, national origin or heritage, disability, sexual orientation, or any characteristic protected by law.</p>
</div>
<p>We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.</p></div>

Cybersecurity Analyst

Search 3547+ Grc analyst jobs near you this March. New roles added regularly across leading industries. Apply today.

3547 grc analyst jobs Near Me

GRC Analyst

GRC Analyst

Senior GRC Analyst

Sr. Information Security GRC Analyst

Information Security Analyst

Information Security Governance Analyst

Cybersecurity Analyst