Governance, Risk & Compliance (GRC) Analyst

Responsibilities

• Own risk assessments across several departments and maintain the centralized risk register.
• Design and maintain a unified, original control framework tailored to CHAOS Industries' operating environment, including a security-by-design approach to systems development and defined: Maximum Tolerable Downtime (MTD), Recovery Point Objective (RPO), and Recovery Time Objective (RTO) for critical systems.
• Write and maintain policy that goes beyond minimum mandatory compliance, building genuine security maturity rather than satisfying the floor of any one requirement.
• Manage GRC tooling and related workflows to support risk assessments, control monitoring, and reporting.
• Prepare for, coordinate, and help run third-party and certification audits, including evidence collection, gap assessments, and auditor liaison.
• Report regularly to the Program Director and executive stakeholders on risk posture, audit status, and program maturity.
• Support customer, vendor, supplier, and subcontractor cybersecurity risk management, including questionnaires, contract reviews, security expectations, and customer-facing services.
• Cook cybersecurity audits, assessments, evidence requests, customer reviews, and remediation tracking in partnership with Legal, Compliance, commercial teams, IT, and business leaders.

Requirements

• Bachelor’s degree or equivalent experience in computer science, cybersecurity, information security, Information Technology, Information Assurance, or a related field, or equivalent practical experience.
• Deep knowledge of NIST CSF, NIST RMF, the ISO/IEC 27000 series, UK Cyber Essentials, CMMC/NIST 800-171, NIST 800-53.
• Experience selecting, implementing, or administering GRC tooling and workflows.
• Exposure to widely recognized governance, risk, and compliance frameworks spanning security, privacy, and quality management domains.
• Familiarity with OT/ICS security concepts.
• Minimum of 5 years hands-on GRC or compliance experience combined with prior experience in a DoD environment or military service.
• Directly supported a third-party or certification audit from evidence collection through closure.
• Has directly performed or directly supported a formal risk assessment (identification, scoring, and treatment) using a defined methodology.

Preferred Requirements

• Experience supporting third-party audits in a cloud-centric environment.
• Has built or materially contributed to a risk register, control framework, or compliance program, not only operated within one already established elsewhere.
• Written policy or procedure documentation that a non-security audience could follow and act on.

Benefits

Health Benefits: Medical, dental, and vision benefits 100% paid for by the company.

Additional benefits: 401k (+ 50% company match up to 6% of pay), FSA, HSA, life insurance, and more.

Our Perks: Free daily lunch, ‘No meeting Fridays’, unlimited PTO, casual dress code.

Compensation Components: Competitive base salaries, generous pre-IPO stock option grants, relocation assistance, and (coming soon!) annual bonuses.

Team Growth: 350 employees and counting across 5 global offices.

Base Salary Range: $120,000 - 150,000.