IT Risk & GRC Analyst

Overview

We are seeking a Cybersecurity Risk & GRC Analyst to lead and mature our IT and cybersecurity risk management program. This role is best suited for a professional who has owned and led a cyber risk register, defined risk metrics and processes, and performed vendor and third-party security risk assessments.

This is not an audit-only role. While audits and compliance are part of the ecosystem, the primary focus is risk identification, assessment, tracking, and mitigation across the organization.

• Own and manage the IT/cyber risk register, including:
• Risk methodology and scoring
• Metrics, reporting, and dashboards
• Risk lifecycle management and remediation tracking
• Lead IT and cybersecurity risk assessments, documenting risks, impacts, likelihood, and treatment plans
• Support and enhance the vendor and third-party risk management process, including:
• Reviewing vendor security assessments
• Mapping vendor controls to internal and external frameworks
• Supporting cybersecurity reviews during onboarding and renewals
• Use a GRC platform (Logic Gate) to document and track risks, controls, and assessments
• Map risks and controls to frameworks such as NIST CSF, ISO 27001, FedRAMP, CCSK
• Coordinate with internal teams to monitor the effectiveness of security controls
• Contribute to the development and updates of security policies and standards (policy ownership is not required)
• Support security incident response activities as needed (supporting role only)
• Contribute to security and risk requirements for new systems and initiatives
• Assist with AI risk and governance assessments, aligned to NIST CSF

• 5+ years of experience in one or more information security domains, such as:
• Vendor or third-party risk management
• Security governance or GRC
• Must have experience leading or owning a cyber risk register
• Hands-on experience with vendor security assessments and control mapping
• Strong understanding of risk frameworks and methodologies
• Familiarity with frameworks such as NIST CSF and ISO 27001
• Strong communication skills and experience working cross-functionally

• Experience supporting Federal agency programs (e.g., FedRAMP)
• Experience with AI governance or AI risk management
• Experience with GRC platforms (Logic Gate or similar)
• One or more certifications:
• CRISC
• CISSP
• CCSK / CSA

• Mid-Senior level

• Full-time

• Analyst
• Industries:
  Technology, Information and Media

Apply BELOW