GRC Analyst III

reliance•Chicago, IL

1d•Onsite

About The Position

The GRC Analyst III serves as a lead contributor within the Information Security organization and will help design, build, and mature Reliance’s enterprise Governance, Risk & Compliance program from the ground up. This role will lead day-to-day GRC program execution, including GRC platform implementation, control framework development, policy and exception governance, enterprise risk tracking, compliance evidence management, third-party risk coordination, and executive-ready reporting. The GRC Analyst III will partner closely with Information Security, IT, Internal Audit, Corporate Risk, Legal, Procurement, business stakeholders, and control owners to establish scalable, repeatable, and audit-defensible processes. This position requires a hands-on lead who can translate regulatory and security requirements into practical operating procedures, drive accountability across teams, mentor junior contributors, and help create the foundation for a mature, measurable, enterprise-wide GRC capability.

Requirements

Bachelor’s degree in Information Systems, Cybersecurity, Risk Management, Business, Audit, or a related field; equivalent work experience may be considered.
7+ years of experience in GRC, information security, IT risk management, compliance, audit, third-party risk, or a related discipline, with demonstrated ownership of complex program or process areas.
Experience helping implement, administer, or mature a GRC platform, including control libraries, risk registers, workflows, assessments, issue tracking, exception management, evidence repositories, and reporting dashboards.
Strong working knowledge of common security, risk, and compliance frameworks such as NIST CSF, NIST SP 800-53, NIST SP 800-171, CIS Controls, ISO/IEC 27001, SOC 2, CMMC, DFARS, or similar control frameworks.
Demonstrated ability to lead risk assessments, document control gaps, evaluate risk, define remediation plans, assign ownership, track due dates, and communicate status to technical and non-technical stakeholders.
Experience coordinating internal audits, external audits, customer compliance requests, control testing support, evidence collection, issue remediation, and audit-ready documentation.
Ability to build structure in an evolving program, create repeatable processes, write clear procedures, define measurable outcomes, and drive accountability across multiple stakeholder groups.
Strong analytical, organizational, documentation, and project coordination skills, with the ability to manage competing priorities in an enterprise environment.
Strong written, verbal, and presentation communication skills, including the ability to translate technical, regulatory, and audit concepts into practical guidance and executive-ready reporting.
Must be self-motivated, detail-oriented, and able to work independently with minimal supervision while partnering effectively with Information Security, IT, Internal Audit, Corporate Risk, Legal, Procurement, and business stakeholders.

Nice To Haves

Experience with policy lifecycle management, standards development, exception management, risk acceptance documentation, and governance reporting preferred.
Experience reviewing vendor security artifacts such as SOC reports, questionnaires, certifications, security addenda, and remediation plans preferred.
Professional certification preferred, such as CISA, CRISC, CGRC, CISM, CISSP, Security+, ISO/IEC 27001 Lead Implementer or Lead Auditor, or Cyber AB CMMC Certified Professional.

Responsibilities

Lead the implementation and operational buildout of Reliance’s enterprise Governance, Risk & Compliance program.
Help define the target-state GRC operating model, including program processes, roles and responsibilities, intake channels, workflows, reporting expectations, and governance routines.
Lead configuration, rollout, data quality, and continuous improvement of the GRC platform, including risk registers, control libraries, assessment workflows, issue tracking, exception management, and dashboards.
Create practical procedures, templates, standards, and operating documentation that allow the GRC program to scale across business units and control owners.
Establish repeatable processes for identifying, assessing, documenting, and reporting information security and compliance risk.
Lead risk assessments with technical, business, and compliance stakeholders; document risks, control gaps, compensating controls, remediation plans, owners, due dates, and residual risk decisions.
Develop and maintain risk dashboards, KPIs, KRIs, and leadership reporting that communicate risk posture, remediation progress, exception aging, audit readiness, and control performance.
Translate findings from assessments, audits, vulnerability reviews, vendor reviews, and security tools into prioritized risk records and action plans.
Lead consistent governance practices for policy lifecycle management and risk-based exceptions.
Coordinate policy and standard review cycles, stakeholder feedback, approvals, publication, acknowledgements, and related evidence.
Design and operate an exception process covering intake, risk evaluation, documentation, approval routing, renewal cadence, and closure tracking.
Partner with control owners to ensure exceptions clearly document business need, risk rationale, compensating controls, expiration dates, and remediation commitments.
Build and operate audit-defensible processes for internal, external, and regulatory compliance activities.
Coordinate evidence requests, control owner responses, issue tracking, remediation updates, and status reporting for internal audits, external audits, customer requests, and compliance assessments.
Develop control evidence standards, evidence retention practices, testing support procedures, and quality checks to improve consistency and audit readiness.
Support governance activities related to frameworks and obligations such as NIST, CIS Controls, SOC 2, CMMC, DFARS, and other applicable security or compliance requirements.
Lead governance activities that improve visibility into vendor, supplier, and service provider risk.
Review vendor security questionnaires, SOC reports, certifications, contract security requirements, and due-diligence artifacts to identify and communicate risk.
Partner with Procurement, Legal, Information Security, IT, and business owners to document risk decisions, track remediation, and improve third-party governance processes.
Mentor junior team members and help establish consistent expectations for documentation quality, stakeholder follow-up, issue ownership, and executive-ready communication.
Pursues training and development opportunities; strives to continuously build knowledge and skills
Assist personnel in other IT departments to resolve technical and/or application issues
Participates and assists with internal and external audits
Other duties as requested