Senior GRC Security Analyst

This is a remote role.

Candidates must already live in the United States and be eligible to get a CJIS certificate, which requires US Citizenship.

At Lexipol, our mission is to create safer communities and empower the individuals on the front lines with market-leading content and technology. Our top-notch team works closely with law enforcement, fire, EMS, corrections, and local government professionals to tailor our solutions to better address today's challenges and keep first responders coming home safely at the end of each shift.

Working at Lexipol means making a difference — day in and day out.

Lexipol holds itself to the same standard of trust and accountability we ask of the agencies we serve. Two of our products require CJI (Criminal Justice Information) authorization, and Lexipol already maintains SOC 2 and CJIS compliance today. We are now pursuing GovRAMP authorization for the first time, and our control environment increasingly maps to the NIST 800-53 Rev. 5 (Moderate) baseline that GovRAMP is built on.

Reporting to the VP, Internal Technology, the Senior GRC Analyst will own our security audit program end-to-end — maintaining what's already in place and leading GovRAMP from the ground up — while serving as the company's go-to expert on controls.

This role will contribute to Lexipol's security and compliance goals, including:

• Maintaining Lexipol's existing SOC 2 and CJIS compliance year over year, including CJI authorization for both current and next-generation versions of the affected product.
• Leading Lexipol's first-ever GovRAMP authorization from readiness through final assessment, as the primary point of contact for the assessor.
• Building and maintaining a single control framework and control library that maps Lexipol's practices to CJIS, GovRAMP, SOC 2, NIST 800-53 Rev. 5 (Moderate), and other frameworks as they arise.
• Standing up repeatable evidence-collection and control-testing processes so audits become faster and less disruptive each cycle.
• Acting as the company's internal subject matter expert on security and compliance controls, advising engineering, IT, and business teams throughout the year — not just during audit season.
• Tracking findings and corrective action plans to closure, and reporting audit status and control health to leadership.

• Own end-to-end planning and execution of Lexipol's ongoing SOC 2 (Type I/II) and CJIS audits, while also leading the company's first GovRAMP authorization (built on the NIST 800-53 Rev. 5 Moderate baseline) from scoping through final assessment.
• Maintain CJI authorization for both product lines that require it, including the newer version, ensuring neither lapses as the products evolve.
• Design, document, and maintain Lexipol's control framework, mapping shared controls across multiple compliance regimes to reduce duplicate work.
• Perform ongoing control testing and self-assessments between formal audit cycles to catch gaps before an auditor does.
• Partner with Engineering, IT, Dev Ops, and Product teams to translate audit and control requirements into practical, implementable safeguards.
• Maintain the risk register and control matrix, and drive remediation plans for identified gaps and findings to on-time closure.
• Serve as the internal SME on security and compliance controls, fielding questions from sales, customer success, and product teams responding to customer security questionnaires and due‑diligence requests.
• Develop and maintain audit playbooks, policies, and procedures so institutional knowledge doesn't live in one person's head.
• Monitor changes to CJIS, GovRAMP, SOC 2, NIST 800-53 Rev. 5 (Moderate), and related frameworks, and advise the Head of IT and…