Cybersecurity Compliance Analyst

Job – IT Business Consultant (Cybersecurity Compliance Analyst)

Location: Spring TX – onsite

Duration: 4-6 months with the possibility of extension

Seeking a Cybersecurity Compliance Analyst to support compliance evaluations, risk assessments, audit readiness, and security governance activities. This role works closely with Cybersecurity, GRC, IT teams, Application Owners, and Business Stakeholders to ensure internal applications comply with security policies and standards.

• Conduct compliance evaluations and review evidence for internal applications.
• Perform risk-based assessments and recommend remediation or compensating controls.
• Collaborate with GRC, Cybersecurity, IT, and business teams to manage compliance requests.
• Build and maintain dashboards for assessment tracking, aging, and closure metrics.
• Support internal and external audits by providing documentation and control evidence.
• Identify process improvements and contribute to security policy updates.
• Promote cybersecurity awareness and compliance across business units.

• 3+ years of experience in IT Security, GRC, Compliance, or IT Operations.
• Knowledge of security frameworks such as National Institute of Standards and Technology CSF, ISO/IEC 27001, ISO/IEC 27002, or CIS Controls.
• Experience assessing compliance of internal applications.
• Familiarity with GRC/ITSM tools such as Service Now, Jira, Archer, or One Trust.
• Strong analytical, communication, organizational, and stakeholder management skills.

• Exposure to cloud security concepts in AWS, Azure, or Google Cloud Platform (GCP).
• Security certifications such as Security+, CISSP, or CISM.
• Experience in regulated industries and dashboard/reporting tools like Power BI, Tableau, or Splunk.

Suitable for professionals working as Cybersecurity Analysts, GRC Analysts, IT Compliance Analysts, Information Security Analysts, or Risk & Compliance Specialists. The role is focused on compliance, governance, risk management, audits, and policy enforcement rather than hands-on security engineering or SOC operations.