Principal GRC Analyst

Company Summary

Business Summary

Position Responsibilities

• As a senior analyst: lead cloud SaaS applications through various audit frameworks and assessments such as SOC 1, SOC 2, NIST 800-53, NIST 800-171, CMMC, ISO, FedRAMP, PCI DSS, CIS, CSA CSM, or other information security regulations.
• Lead and/or support end-to-end audit engagements (internal and external), including scoping, evidence requests, control testing, issue tracking, and final report support.
• Assess and communicate administrative, technical, and security controls across major cloud platforms, including Oracle Cloud Infrastructure (OCI), Amazon Web Services (AWS), and Microsoft Azure.
• Demonstrate the ability to apply project management practices to plan, track, and deliver security assessments, including hands-on use of Jira for epics/stories, backlog grooming, and stakeholder reporting.
• Use automation and AI responsibly to streamline evidence collection, control mapping, and recurring reporting while maintaining appropriate human review.
• Define, build, and maintain recurring GRC metrics and dashboards (monthly/quarterly), and present trends, risks, and remediation status to senior leadership.
• Draft, maintain, and socialize security policies/standards and System Security Plans (SSPs), including control narratives, implementation details, and evidence references.
• Communicate clearly with engineering, product, and auditors, and produce high-quality audit deliverables (e.g., narratives, evidence packages, and status reporting).
• Manage risk register items and PoA&Ms end-to-end—identify control gaps, partner with stakeholders on remediation plans, and track progress through continuous monitoring.
• Own (or serve as backup owner for) key GRC programs by maintaining procedures, SLAs, and artifacts for audits and customer requests (e.g., policy management and security due diligence questionnaires to support RFIs and RFPs).
• Actively participate in initiatives aimed at enhancing team processes and procedures.
• Help maintain and curate annual compliance training content and improve training process.
• Interpret control requirements and regulatory obligations accurately, and translate them into clear, testable expectations for technical teams.
• Participate in incident response reviews and RCAs by documenting control failures, corrective actions, and follow-up evidence for closure.

Qualifications

• B.S. degree (Information Security, Computer Science, MIS, or equivalent program preferred) from an accredited college/university.
• 3+ years supporting audits & compliance work across common frameworks (see framework list above), with demonstrated evidence collection, control testing, & remediation tracking.
• Minimum 3 years of combined experience with implementing and/or assessing: IT audit, IT risk management, Cloud security & compliance, internal audit function, Information Technology General Controls (ITGC), Information security operations.
• Experience supporting government-related compliance efforts (e.g., FedRAMP- or DoD-aligned expectations) within cloud environments, including evidence packaging & stakeholder coordination.
• Hold (or be actively pursuing) relevant certifications such as CISA, CISSP, CCSK/CCAK, or major cloud security certifications (Azure/AWS/GCP), with active status preferred.
• Work independently, exercise good judgment & proactively seeks guidance as needed.
• Manage time effectively across multiple priorities & concurrent projects.
• Demonstrate strong analytical & critical-thinking skills with business & technical acumen.
• Communicate clearly in writing, verbally & collaborate effectively with diverse stakeholders.
• Thrives in a fast-paced, collaborative environment & contribute to shared outcomes.
• Follow directions from senior staff & supports peers to deliver high-quality, time-bound work.
• Continuously learn through structured, on-the-job, & self-directed development.
• CCAK/CCSK, CISSP, CISA, or other related information security certification desired.
• Demonstrable FedRAMP, ISO & SOC Security Framework experience desired.
• Experience with effective AI usage, data analysis, report preparation, automation, & templating of repeat processes.

Career Interests

Position Type

Travel Requirements

• 10%

Applicant Privacy Notice