Governance, Risk, and Compliance (GRC) Analyst

Remote, Anywhere USA • Austin, TX

1d • Remote

About The Position

The GRC Analyst executes governance, risk, and compliance activities by monitoring adherence to regulatory, contractual, and policy requirements; conducting assessments; managing control evidence; and performing third-party risk reviews. The position is remote and may require obtaining and maintaining a federal public trust security clearance because the employer is a federal contractor.

The analyst administers vendor risk assessments using structured supply-chain and security review processes consistent with NIST and organizational TPRM policies. The role supports authorization and audit activities, evaluates vendor security and compliance, tracks exceptions and risk acceptances, and assists system owners with remediation planning and follow-up.

Requirements

• Bachelor’s degree from an accredited college or university, or qualifying additional experience in an information technology system and network role or other related areas substituted year for year.
• One year of experience in Third Party Risk Management, GRC, or supporting enterprise security/compliance programs.
• Have or obtain within one year of employment or promotion a professional security certification, such as CISA, CRISC, CGRC, CTPRP, CSCRP, or CIPM.
• May be subject to obtaining and maintaining a federal public trust security clearance.

Responsibilities

• Administer ongoing third-party vendor risk assessments using structured supply-chain and security review processes consistent with NIST and organizational TPRM policies.
• Review vendor SOC reports, security attestations, cloud authorization artifacts, network diagrams, and compliance certifications.
• Support ATO, reauthorization, and external audit engagements, including CMS, GSA, federal partners, and internal QA.
• Conduct initial and recurring vendor assessments to evaluate security posture, misconfiguration risks, data handling practices, and alignment with contractual requirements.
• Track exceptions, deviations, and risk acceptances through appropriate governance channels.
• Assist system owners in developing POA&Ms based on assessment findings, track remediation status, and ensure timely closure.

Benefits

• Medical, dental, vision, life, accidental death and dismemberment, and short- and long-term disability insurance
• Section 125 plan
• 401K
• Competitive salary
• License/credentials reimbursement
• Tuition reimbursement

What This Job Offers

• Job Type: Full-time