Cybersecurity GRC Analyst

Cleveland Brothers Equipment Co•Harrisburg, PA

About The Position

The Cybersecurity GRC role is responsible for establishing, maintaining, and validating governance, risk, and compliance programs that ensure the organization meets cybersecurity, regulatory, and contractual requirements. This role translates security frameworks and obligations into policies, standards, evidence, and repeatable processes, enabling audit readiness and informed risk based decision making across the business.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Computer Science or related field/equivalent practical experience
Strong understanding of cybersecurity governance, risk, and compliance (GRC) concepts.
Working knowledge of cybersecurity frameworks (e.g. NIST CSF, SOC 2, CIS, etc.).
Experience developing and maintaining policies, standards, and procedures.
Ability to interpret regulatory and contractual security requirements.
Strong organizational skills with attention to detail.
Experience tracking controls, evidence, and remediation activities.
Ability to work cross‑functionally with technical and non‑technical teams.
Strong written communication skills, especially for documentation and executive reporting.
Analytical mindset with the ability to assess and articulate risk.
Ability to document technical controls, standards, and procedures clearly.
Strong verbal and written communication skills, with the ability to explain technical concepts to non‑technical audiences.

Responsibilities

Manage cybersecurity compliance programs.
Develop, maintain, and update security policies, standards, and procedures.
Coordinate and maintain audit readiness, including evidence collection and tracking.
Conduct cybersecurity and compliance risk assessments and maintain the enterprise risk register.
Track control maturity, remediation activities, and compliance status.
Partner with IT, Cybersecurity, and business teams to facilitate and ensure controls are implemented and operating as intended.
Translate regulatory and contractual requirements into actionable internal requirements.
Support internal and external audits, assessments, and reviews.
Support security awareness training programs.
Prepare executive‑level compliance, risk, and status reporting.
Assist with incident response from a compliance and documentation perspective.
Promote consistent governance and documentation practices across teams.
Other duties as required.