Senior GRC Analyst - Information Security

BETA Technologies•South Burlington, VT

3d•$130,000 - $150,000

About The Position

At BETA Technologies, we apply our intellectual curiosity, passion for aviation, and commitment to sustainability toward a shared mission of revolutionizing electric aviation. Regardless of the position one holds, each team member brings their talent and desire to positively impact the environment and lives of others in a refreshing, vibrant, and inclusive culture. BETA Technologies is seeking an experienced Senior Governance, Risk, and Compliance (GRC) Analyst to serve as a strategic partner in building and maturing our GRC program. This role will initially focus on establishing robust GRC capabilities within our Information Security group, then expand the program across our broader enterprise operations, including aerospace engineering, manufacturing, supply chain, and defense programs. This is a hands-on, high-impact role for a GRC professional who thrives in a fast-paced, innovative environment where aviation safety, cybersecurity, and regulatory compliance intersect. You'll help shape the GRC and information security culture at BETA as we rapidly scale.

Requirements

7+ years of hands-on GRC experience, with at least 5 years focused on information security risk and compliance
Experience managing external audits and assessments (SOC 2, ISO certifications, CMMC assessments) and associated internal preparation
Deep working knowledge of NIST CSF, NIST 800-53, NIST 800-171, ISO 27001/27002, and risk management methodologies
Direct experience with compliance frameworks applicable to defense contractors (NISPOM, DFARS, ITAR/EAR, CUI protection)
Proven track record conducting enterprise risk assessments, threat modeling, and risk quantification
Experience creating security policies, standards, procedures, and control documentation
Excellent written and verbal communication skills; ability to translate technical risk to business stakeholders
Demonstrated ability to influence without authority and build strong cross-functional relationships
Proficiency with GRC platforms (Vanta, Upguard, etc.) and common collaboration tools (Slack, Jira, Confluence, etc.)

Nice To Haves

One or more professional certifications, such as CRISC, CISSP, CISA, CISM, or ISO 27001 Lead Auditor
Experience working in the Defense and Aerospace industry
Understanding of information technology and operational technology/industrial control systems security in manufacturing environments
Experience implementing or administering GRC platforms and integrated risk management tools
Track record of building GRC programs from the ground up or through significant maturity transitions
Familiarity with privacy regulations (GDPR, CCPA) and data protection frameworks

Responsibilities

Design, implement, and mature GRC frameworks aligned with industry standards (NIST CSF, ISO 27001, CMMC)
Coordinate internal and external audits, assessments, and certifications (SOC 2, ISO 27001, CMMC, etc.)
Lead the buildout of InfoSec GRC capabilities including risk assessments, policy development, compliance management, and security control implementation
Develop scalable GRC processes, templates, and tools that can be adapted enterprise-wide as the program expands
Conduct comprehensive risk assessments across IT systems, operational technology (OT), and critical business processes
Develop risk treatment plans and monitor remediation activities to closure
Translate complex regulatory requirements into actionable control requirements for technical and operational teams
Monitor regulatory landscape for emerging compliance obligations relevant to electric aviation and defense contracting
Support control testing and validation activities
Conduct vendor security assessments/due diligence reviews and manage vendor compliance documentation and ongoing risk monitoring
Work across departments including InfoSec, IT, Engineering, Manufacturing, Quality, Legal, and Program Management to embed GRC practices
Drive continuous improvement of GRC processes based on lessons learned and industry best practices