Governance, Risk & Compliance (GRC) Analyst
Core
Own and mature the cybersecurity GRC program by establishing governance structures, policies, and risk processes for a defense technology company.
Role type
GRC Analyst (Cybersecurity)
Builds
Cybersecurity risk processes, control frameworks, and compliance programs
Domain
Defense technology / Cybersecurity
Required skills
NIST CSF, NIST RMF, ISO/IEC 27000 series, CMMC/NIST 800-171, NIST 800-53, GRC tooling, OT/ICS security concepts, risk assessment methodology, third-party audit support
Preferred skills
Cloud-centric third-party audit support, building risk registers and control frameworks, writing policy for non-security audiences
Technologies
NIST CSF, NIST RMF, ISO/IEC 27000, CMMC, NIST 800-171, NIST 800-53
Responsibilities
Own risk assessments and maintain centralized risk register; Design and maintain unified control framework with security-by-design approach; Write and maintain security policies beyond minimum compliance; Manage GRC tooling and workflows; Coordinate third-party and certification audits; Act as connective tissue between departments to drive security requirements; Report on risk posture and program maturity to executives
Seniority
Mid-level, hands-on IC