GRC Analyst

Sargent & Lundy • Chicago, IL

1d • $75,210 - $115,210 • Hybrid

About The Position

Sargent & Lundy is seeking a detail-oriented, organized, and data-driven GRC Analyst to support its Governance, Risk, and Compliance team, with a primary emphasis on client contract cybersecurity obligations and client assurance. Working under the direction of the Senior GRC Analyst, the position analyzes client contracts for cybersecurity terms, coordinates responses to client security assessments, and helps organize and track contractual obligations. The analyst contributes to executive visibility into obligation status through data analysis and dashboard reporting, supports security awareness training and Hoxhunt phishing campaigns, assists with third-party vendor and software risk assessments, and supports NIST 800-171 and ISO 27001 audit and compliance tracking. The analyst owns assigned tasks and projects, while the Senior GRC Analyst retains overall accountability for GRC program areas.

The role works across Legal, Contracts, Procurement, IT, and business teams to embed contract security requirements into day-to-day operations and improve GRC processes. The position uses GRC/TPRM platforms such as Hyperproof or ProcessUnity, and analytics and reporting tools such as Power BI and Excel. The schedule is hybrid: three days per week in the downtown Chicago office and two days working remotely from home.

Sargent & Lundy describes its benefits as comprehensive and award-winning, with healthcare plans, paid time off, and other programs. The compensation range is $75,210 to $115,210, and eligible employees may also be eligible for a yearly discretionary bonus. The company does not sponsor employees for U.S. work authorization for this position.

Requirements

• Bachelor’s degree in information systems, cybersecurity, business, or a related field, or equivalent professional experience.
• 3–5 years of experience analyzing contracts for cybersecurity terms and coordinating responses to client security assessments.
• Experience with the ISO 27001 framework, including ISMS requirements, Annex A controls, and audit support.
• Ability to organize, track, and drive a high volume of obligations and deadlines to completion, with strong attention to detail.
• Data analysis skills and ability to build and maintain dashboards, such as in Power BI or Excel, and prepare executive-ready reporting.
• Strong written and verbal communication skills, including the ability to explain contract requirements in plain language to technical and business stakeholders.

Nice To Haves

• 3–5 years of experience performing third-party vendor and software risk assessments.
• Experience with GRC tools such as Hyperproof, ProcessUnity, or similar platforms.
• Experience supporting government work or government contracts, including NIST 800-171 requirements.
• Experience supporting security awareness programs or phishing simulation platforms such as Hoxhunt.
• Interest in learning and effectively using emerging technologies where relevant to the role; experience with AI, automation, programming, or similar technologies is valued but is not required unless identified elsewhere in the job description.

Responsibilities

• Review client contracts, master service agreements, terms and conditions, and flow-down clauses for cybersecurity, data protection, incident notification, audit rights, and regulatory requirements such as NIST 800-171, DFARS, and CEII.
• Identify gaps between contract requirements and company practices, and support the Senior GRC Analyst in advising Legal and Contracts on positions and exceptions.
• Support intake and tracking of client security questionnaires, due diligence requests, and client audits, and drive assigned responses to completion on time.
• Coordinate input from Information Security, IT, Legal, and business subject matter experts, and help maintain approved standard responses and supporting evidence.
• Maintain the Information Security contract obligation tracker by recording owners, due dates, and evidence requirements; follow up on obligations; and flag at-risk or overdue items to the Senior GRC Analyst.
• Build and maintain dashboards, such as in Power BI or Excel, showing obligation status, upcoming deadlines, client audit rights, assessment volume and turnaround, and risk trends.
• Prepare data and insights for executive-ready reporting.
• Help develop security awareness training content and communications, support training delivery, and help execute Hoxhunt phishing simulation campaigns.
• Analyze security awareness and phishing simulation results and contribute to trend reporting.
• Conduct assigned third-party vendor and software intake risk reviews; evaluate security questionnaires, SOC reports, and certifications; recommend risk tiers; and track findings and remediation through closure with Procurement.
• Coordinate evidence collection and track control status, findings, POA&Ms, and corrective actions for NIST 800-171 and ISO 27001; support internal and external audits.
• Conduct risk assessments for existing and new information assets, including software, AI, cloud, endpoint, and network assets.
• Use GRC platforms such as Hyperproof or ProcessUnity to manage risks, obligations, assessments, evidence, and findings, and maintain accurate and complete data.
• Coordinate with Legal, Contracts, Procurement, IT, and project teams to embed contract security requirements into operations.
• Help standardize templates, playbooks, and workflows, and support automation to reduce manual effort and improve response times.
• Own assigned tasks and projects through completion, keeping the Senior GRC Analyst informed of status, risks, and blockers.
• Support government contract compliance reviews and tracking.

Benefits

• Medical, dental, and vision plans.
• Life and accident insurance.
• Disability coverage.
• Employee Assistance Program (EAP).
• Back-up daycare.
• Flexible Spending Account (FSA) and Health Savings Account (HSA).
• 401(k).
• Pre-tax commuter account.
• Merit Scholarship Program.
• Employee discount program.
• Corporate Charitable Giving Program.
• Tuition assistance.
• First Professional Licensure Bonus.
• Employee Referral Bonus.
• Paid annual personal/sick time (PST).
• Paid vacation.
• Paid holidays.
• Paid parental leave.
• Paid bereavement leave.
• Flexible work arrangements.
• Eligible employees may be eligible to participate in a yearly discretionary bonus.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level