IT Governance, Risk and Compliance Analyst

American Red Cross

82d • $90,000 - $110,000

About The Position

As an IT GRC Analyst, you will help mature and maintain the organization’s Governance, Risk, and Compliance (GRC) program. You will focus on control assessment by evaluating, reviewing, tracking and supporting policies and controls aligned with NIST 800-53/171, COBIT, ISO 27001, and SOC 2 frameworks. This role works cross-functionally with IT, Information Security, Internal Audit, Legal, and Finance to assess risks, improve processes, and support audit readiness. This position will be virtually located/work-from home and need to work east-coast hours, with typical workday starting at 8am.

Requirements

• Bachelor’s degree in Information Technology, Cybersecurity, Information Systems, or a closely related discipline.
• Minimum 4 years of experience in IT audit, compliance, or Information Security.
• Strong understanding of control frameworks: NIST, ISO, COBIT, FedRAMP, SOC 2.
• Experience with control assessments, documentation review, audit coordination, and utilizing ServiceNow IRM (preferred) to manage GRC workflows, automate evidence collection, and streamline issue remediation.
• Skilled in drafting and reviewing IT policies, standards and procedures.
• Strong communication, analytical, and project management skills.
• Experience working cross-functionally with technical and business teams.
• Familiarity with SAFe Agile or similar iterative delivery frameworks.

Nice To Haves

• Certifications such as CISA, CRISC, CISSP, CISM are a plus.

Responsibilities

• Support daily GRC operations, policy development, and audit readiness.
• Collaborate with stakeholders to strengthen internal controls and ensure compliance with federal regulations and industry standards.
• Promote control awareness and accountability through training and consultation.
• Maintain GRC tools (e.g., ServiceNow IRM) and stay current on technology trends.
• Evaluate IT control effectiveness across infrastructure, applications, and cloud environments.
• Review documentation, identify gaps, and recommend improvements.
• Track and report control findings, risks, and remediation plans.
• Support exception and risk acceptance processes.
• Coordinate with internal/external auditors and business units during assessments.
• Provide consulting and first-level support for audit activities and findings.
• Assist in developing and executing remediation strategies.
• Assist in drafting, reviewing, and implementing IT policies, standards, and procedures.
• Analyze regulatory requirements and recommend updates to improve compliance.

Benefits

• Medical, Dental Vision plans
• Health Spending Accounts & Flexible Spending Accounts
• PTO: Starting at 19 days a year; based on type of job and tenure
• Holidays: 11 paid holidays comprised of six core holidays and five floating holidays
• 401K with up to 6% match
• Paid Family Leave
• Employee Assistance
• Disability and Insurance: Short + Long Term
• Service Awards and recognition

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: Bachelor's degree
• Number of Employees: 5,001-10,000 employees