Senior IT GRC Analyst

CMG Financial

8d • Remote

About The Position

The Senior IT GRC Analyst leads policy development and audit execution within CMG's IT Governance, Risk, and Compliance program, with particular emphasis on CMG's upcoming SOC 2 readiness effort. This role works closely with the GRC team and the broader IT department to plan and execute audit engagements, maintain the policy framework, and manage auditor relationships. The Senior IT GRC Analyst operates with a high degree of autonomy and is expected to navigate ambiguity in a regulated environment.

Requirements

• Bachelor's degree in Information Technology, Cybersecurity, or a related field (equivalent experience considered).
• 5+ years of experience in IT audit, compliance, or GRC in an enterprise IT environment.
• Demonstrated experience managing SOC 2 audit cycles (Type I or Type II) from scoping through remediation.
• Direct experience in financial services, mortgage lending, or related regulated industries, with working knowledge of applicable regulations (GLBA, CFPB, NYDFS).
• Strong working knowledge of relevant IT compliance frameworks, such as NIST CSF, ISO 27001, or SOX.
• Strong policy writing and documentation skills.
• Ability to work independently amid ambiguity, exercising sound judgment on scope and prioritization.
• Excellent written and verbal communication skills, with the ability to explain technical and compliance matters to varied audiences.

Nice To Haves

• Relevant certifications preferred: CISA, CRISC, or GRCP.

Responsibilities

• Lead CMG's SOC 2 readiness assessment, including scope definition, gap analysis, and control design, in partnership with the IT GRC Manager.
• Serve as a point of contact during audit engagements and regulatory exams.
• Develop, maintain, and update IT policies, standards, and procedures to align with NIST CSF and other applicable regulatory requirements.
• Plan and execute audit activities, including scheduling, control walkthroughs, evidence gathering, and findings documentation.
• Identify control gaps, coordinate remediation planning with control owners, tracking findings and remediation status through the risk register.
• Provide guidance to other GRC team members and IT leadership on audit and policy matters.
• Research regulatory and framework changes relevant to mortgage lending and financial services, and translate them into policy updates.
• Contribute to the ongoing development and improvement of GRC processes and tooling.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior