GRC Analyst

Infotech Current Openings•Gainesville, FL

2d•Remote

About The Position

Infotech is seeking a GRC Analyst to run the day-to-day operations of its SOC 2 Type II and GovRAMP programs. The role partners with engineering, IT, and business teams to collect evidence, document controls, and address gaps. The Security & Compliance (GRC) team is part of Platform Engineering and maintains these programs across Infotech products, including AASHTOWare Project Hosting Services (APHS). The position has no direct reports, but assigns and follows up on compliance tasks with control owners in other teams. It requires up to 10% travel and occasional after-hours work during audit and assessment periods. The role is not eligible for sponsorship. A resume is required; a cover letter is recommended.

Requirements

At least 5 years of experience in GRC, security compliance, or IT audit.
Ownership of at least one full SOC 2 Type II audit cycle or GovRAMP assessment, from readiness through remediation.
Experience writing security policies and control documentation.
Ability to coordinate deliverables across several teams and keep work moving without close direction.
Familiarity with policy as code, such as defining and testing controls with Open Policy Agent, AWS Config rules, or infrastructure-as-code policy checks.
Clear communication with auditors, engineers, and executives.
Ability to lead, investigate, and coordinate security incidents.

Nice To Haves

Experience supporting GovRAMP, StateRAMP, or FedRAMP programs, including POA&M management or continuous monitoring.
Good understanding of cloud security policies.
Certification such as CGRC, CISA, CISSP, CISM, or Security+.
Experience with government or other contract-driven customers.
Administration of Vanta, Drata, or a similar compliance platform.
Ability to read AWS configuration evidence and know what good looks like.
Experience automating compliance work with scripts or APIs.

Responsibilities

Own SOC 2 Type II evidence collection and readiness each audit cycle, from the request list through delivery to auditors.
Support GovRAMP assessments for APHS, including evidence packages, the POA&M, and continuous monitoring deliverables.
Draft and maintain security policies and control narratives aligned with SOC 2 and NIST SP 800-53 Rev. 5.
Administer Vanta and automate evidence collection to reduce manual work for engineering teams.
Perform risk and third-party assessments and verify that technical controls in AWS operate as documented.
Coordinate penetration tests and track findings through closure.
Own the customer security questionnaire process.
Provide backup coverage for audit and assessment activity as directed.
Assign and follow up on compliance tasks with control owners in other teams.
Lead, investigate, and coordinate security incidents.