Staff GRC Analyst
About The Position
Tines is seeking a Staff GRC Analyst to bridge technical engineering teams and external auditors. The role works closely with Security, Engineering, Product, IT, and Legal, examining technical configurations, validating data flows, and helping build automated safeguards across a multi-cloud environment. It is a technical position with independent ownership of an area of responsibility, improving existing approaches, and advising stakeholders as new security requirements are adopted. The position reports to the Director of GRC and can be based remotely in the United States. The analyst will translate security requirements into technical controls and implementation standards, assess technical implementations, define and validate evidence, support FedRAMP authorization and ongoing operations, assist with external assessments and audit readiness, track evolving federal requirements, and identify opportunities to scale compliance using automation and policy-as-code.
Requirements
- 12+ years of experience in security compliance, technical GRC, cloud security, IT audit, or related technical governance roles.
- Hands-on experience translating compliance requirements into technical controls and configuration standards.
- Strong knowledge of cloud/SaaS security, including IAM, encryption, logging, vulnerability management, and secure SDLC.
- Experience supporting FedRAMP authorization, ConMon, POA&M management, and external assessments.
Nice To Haves
- PMP, CISSP, CISM, CISA, or CCSP certification.
Responsibilities
- Partner with Engineering, Security, and Infrastructure teams to translate FedRAMP High, DoD IL4/IL5, CMMC, NIST SP 800-53/800-171, SOC 2, ISO, and other security requirements into actionable technical controls and implementation standards across AWS and Azure.
- Assess technical implementations across infrastructure, networking, containers, databases, IAM, encryption, logging, and vulnerability management for alignment with control requirements.
- Define evidence requirements and work with technical teams to validate control implementation, identify gaps, and drive remediation.
- Support FedRAMP authorization and ongoing operations, including ConMon, POA&M management, vulnerability reporting, evidence packages, and significant change management.
- Support external assessments and audits, including 3PAO engagements and audit readiness.
- Monitor evolving federal requirements, including FedRAMP 20x, and keep stakeholders informed.
- Identify opportunities to scale compliance through automation and policy-as-code.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
