GRC Analyst

the company

northmark compute & cloud (nmc²) is backed by dedicated leadership and investment, with a clear mission as it operates at the bleeding edge of technology. Its goal is to scale and enhance the high-performance computing (hpc) and cloud infrastructure that supports its clients’ research, production, and delivery, enabling breakthroughs that shape the industries of tomorrow. Its engineers build critical infrastructure to eliminate friction in scientific research, simulations, analysis, and decision-making, accelerating discovery and driving faster innovation.

northmark compute & cloud (nmc²) is backed by dedicated leadership and investment, with a clear mission as it operates at the bleeding edge of technology. Its goal is to scale and enhance the high-performance computing (hpc) and cloud infrastructure that supports its clients’ research, production, and delivery, enabling breakthroughs that shape the industries of tomorrow. Its engineers build critical infrastructure to eliminate friction in scientific research, simulations, analysis, and decision-making, accelerating discovery and driving faster innovation.

nmc² is hiring a grc analyst to join the information security team, reporting to the grc & privacy manager and based at our dallas, tx offices at victory commons. This role is the operational engine of nmc²’s security governance program — responsible for the processes, documentation, and cross-functional coordination that keep our compliance posture current and our risk exposure understood. You will run the security change management review process, conduct risk and vendor assessments, maintain the enterprise risk register, and own the lifecycle of nmc²’s security policy library.

Day-to-day, you will work closely with engineering, product, legal, and operations — acting as the connective tissue between technical teams and the governance structures that protect the business. The right person for this role is equally at home authoring a policy document, running a risk workshop with a product team, and producing a clean risk summary for the ciso. You bring strong judgment about where governance adds real value, and you know how to design processes that people actually follow.

• own and operate the security change management review process — triaging incoming it and infrastructure change requests, engaging engineering and it stakeholders, and documenting findings, approvals, and escalations.
• iterate on change management processes, runbooks, and risk criteria to reduce friction for low-risk changes while preserving appropriate rigor for high-risk ones.
• conduct security reviews for new products, features, third‑party integrations, and vendor onboarding, applying a consistent risk‑based assessment methodology and tracking remediation of identified gaps.
• facilitate threat identification workshops and risk discussions with engineering, product, and operations for major initiatives or architectural changes.
• maintain and continuously improve the enterprise information security risk register, ensuring risks are clearly articulated, owned, prioritized, and tracked through to mitigation or acceptance.
• develop risk reporting dashboards and narrative summaries for the ciso and executive leadership; monitor the regulatory and threat landscape for emerging risks that warrant program attention.
• author, revise, and manage the organization’s information security policy library — policies, standards, procedures, and guidelines — aligned to applicable frameworks including iso 27001, soc 2, and nist csf.
• manage the security exception process: collect requests, facilitate risk‑based approvals with the grc manager, and track expiry and renewal.
• monitor adherence to governance…