GRC Analyst

Sargent & Lundy•Chicago, IL

8d•Hybrid

About The Position

Sargent & Lundy is seeking a detail-oriented, organized, and data-driven GRC Analyst to support its Governance, Risk, and Compliance team, primarily by managing client contract cybersecurity obligations and client assurance. Working under the direction of the Senior GRC Analyst, the role analyzes client contracts for cybersecurity terms, coordinates client security assessment responses, tracks contractual obligations, and reports obligation status and risk trends through dashboards. The analyst also supports security awareness training and Hoxhunt phishing campaigns, third-party vendor and software risk assessments, and NIST 800-171 and ISO 27001 audit and compliance tracking. The analyst owns assigned tasks and projects, while the Senior GRC Analyst retains overall accountability for GRC program areas. The role uses GRC and TPRM platforms such as Hyperproof and ProcessUnity, or similar tools, and data analysis and reporting tools such as Power BI and Excel. It coordinates with Legal, Contracts, Procurement, IT, and business teams to embed security requirements in day-to-day operations and improve processes, templates, workflows, and automation. This is a hybrid position requiring three days per week in the downtown Chicago office and two days remote from home. Sargent & Lundy does not sponsor U.S. work authorization for this position.

Requirements

Bachelor’s degree in information systems, cybersecurity, business, or a related field, or equivalent professional experience.
3–5 years of experience analyzing contracts for cybersecurity terms and coordinating responses to client security assessments.
Experience with the ISO 27001 framework, including ISMS requirements, Annex A controls, and audit support.
Ability to organize, track, and drive a high volume of obligations and deadlines to completion with strong attention to detail.
Data analysis skills, including the ability to build and maintain dashboards using tools such as Power BI or Excel and prepare executive-ready reporting.
Strong written and verbal communication skills, including the ability to explain contract requirements in plain language to technical and business stakeholders.

Nice To Haves

3–5 years of experience performing third-party vendor and software risk assessments.
Experience with GRC tools such as Hyperproof, ProcessUnity, or similar platforms.
Experience supporting government work or government contracts, including NIST 800-171 requirements.
Experience supporting security awareness programs or phishing simulation platforms such as Hoxhunt.
Interest in learning and effectively using emerging technologies where relevant to the role; experience with AI, automation, or programming is valued but not required.

Responsibilities

Review client contracts, MSAs, terms and conditions, and flow-down clauses for cybersecurity, data protection, incident notification, audit rights, and regulatory requirements such as NIST 800-171, DFARS, and CEII.
Identify gaps between contract requirements and company practices and support the Senior GRC Analyst in advising Legal and Contracts on positions and exceptions.
Coordinate intake and tracking of client security questionnaires, due diligence requests, and client audits, and drive assigned responses to on-time completion.
Coordinate response input from Information Security, IT, Legal, and business subject matter experts, and help maintain approved standard responses and supporting evidence.
Maintain the Information Security contract obligation tracker, including owners, due dates, and evidence requirements; follow up on obligations and flag at-risk or overdue items.
Build and maintain dashboards showing obligation status, upcoming deadlines, client audit rights, assessment volume and turnaround, and risk trends; prepare data and insights for executive reporting.
Help develop security awareness training content and communications, support delivery, and execute Hoxhunt phishing simulations; analyze results and contribute to trend reporting.
Conduct assigned third-party vendor and software intake risk reviews; evaluate security questionnaires, SOC reports, and certifications; recommend risk tiers; and track findings and remediation with Procurement.
Coordinate evidence collection and track control status, findings, POA&Ms, and corrective actions for NIST 800-171 and ISO 27001; support internal and external audits.
Conduct risk assessments for existing and new information assets, including software, AI, cloud, endpoint, and network assets.
Use GRC platforms such as Hyperproof and ProcessUnity to manage risks, obligations, assessments, evidence, and findings, and maintain accurate and complete data.
Coordinate with Legal, Contracts, Procurement, IT, project teams, and business teams to help embed contract security requirements into day-to-day operations.
Help standardize templates, playbooks, and workflows and support automation to reduce manual effort and improve response times.
Take assigned tasks and projects through completion and keep the Senior GRC Analyst informed of status, risks, and blockers.
Support government contract compliance reviews and tracking.