Senior Governance, Risk & Compliance; GRC) Analyst

We are seeking a Senior Governance, Risk & Compliance (GRC) Analyst for a fully remote contract opportunity supporting a large, regulated organization with a growing Information Security program.

This individual will join the team during an active period of growth across application readiness assessments, risk management, compliance, and security governance initiatives
. The Senior GRC Analyst will help assess risk and controls, analyze findings, coordinate remediation activities, engage stakeholders, and keep multiple security and compliance priorities moving forward.

This is an excellent opportunity for an experienced GRC professional who can operate independently while partnering across Information Security, IT, Finance, Legal, Privacy, Internal Audit, and business teams.

• Lead and support GRC assessments across technology, applications, infrastructure, cloud/SaaS environments, business processes, and third parties.
• Perform IT and information security risk assessments
  , evaluating threats, vulnerabilities, business impact, inherent risk, residual risk, and appropriate risk treatments.
• Support compliance efforts involving SOX, HIPAA, and PCI DSS
  , including scoping, walkthroughs, evidence review, control testing, gap analysis, remediation, and audit readiness.
• Evaluate the design and operating effectiveness of IT and security controls
  , documenting exceptions and validating remediation.
• Support IT SOX
  , including IT general controls (ITGCs), application controls, risk and control matrices, and segregation of duties.
• Contribute to HIPAA security risk assessments and evaluate safeguards surrounding systems and processes handling protected information.
• Support PCI DSS readiness and scoping
  , including review of controls and third-party/vendor compliance evidence.
• Develop and maintain policies, standards, controls, assessment methodologies, and risk documentation
  .
• Map controls and requirements across frameworks including NIST CSF, NIST SP 800-53, ISO 27001, and COBIT
  .
• Review SOC 1/SOC 2 reports
  , certifications, questionnaires, and supporting evidence as part of third-party risk assessments.
• Coordinate internal and external audits, evidence requests, assessment activities, findings, and remediation efforts.
• Partner with technical and business stakeholders to turn compliance requirements and identified risks into practical, actionable controls
  .
• Coordinate GRC projects from planning through completion, managing milestones, dependencies, deliverables, stakeholders, and competing priorities.
• Develop clear risk reporting, assessment findings, metrics, and recommendations for both technical and business audiences.

• 5+ years of experience in GRC, IT risk, information security assurance, IT audit, or a similar discipline.
• Hands‑on experience performing or supporting assessments involving SOX, HIPAA, and PCI DSS
  .
• Strong understanding of risk assessment and risk management methodologies
  .
• Experience evaluating control design and operating effectiveness and working with stakeholders to remediate identified gaps.
• Working knowledge of:
• IT General Controls (ITGCs)
• Identity & Access Management (IAM)
• Privileged access
• Segregation of duties
• Change management
• Logging and monitoring
• Vulnerability management
• Data protection
• Business continuity and disaster recovery
• Experience creating or maintaining risk and control matrices, control narratives, policies, standards, procedures, and testing documentation
  .
• Ability to understand and assess controls across on-premises, cloud, and SaaS environments
  .
• Experience supporting internal and external audits and working directly with control owners.
• Strong project coordination, stakeholder management, communication, and organizational skills
  .
• Ability to independently manage multiple assessments, remediation efforts, and governance initiatives.
• Bachelor's degree in Information Technology, Information Security, Accounting, Business, or a related discipline, or equivalent relevant professional experience.

• CISA, CRISC, CISSP, CISM, CPA
  , or comparable certification.
• Experience using Audit Board, Diligent, or similar GRC platforms
  .
• Experience reviewing SOC 1 and SOC 2 reports
  .
• Experience working within a complex or regulated enterprise environment
  .

Location: Remote

Type: Contract

Schedule: Full-time, 40+ hours per week with flexibility based on business needs

Function: Information…