Junior Governance, Risk, and Compliance Specialist

About the role

NY Creates serves as a bridge for advanced electronics, leads projects that advance R&D in emerging technologies, and generates the jobs of tomorrow. NY Creates also runs some of the most advanced facilities in the world, boasts more than 3,000 industry experts and faculty, and manages public and private investments of approximately $25 billion – placing it at the global epicenter of high-tech innovation and commercialization.

Responsibilities

• Assist with enterprise risk assessments by gathering information, documenting risks, supporting risk discussions, and maintaining assigned portions of the risk register.
• Support third-party risk management activities by coordinating questionnaires, collecting and organizing vendor documentation, tracking outstanding items, and escalating concerns to senior GRC staff.
• Maintain cybersecurity policies, standards, procedures, and related documentation; help track reviews, approvals, and required updates.
• Support internal cybersecurity audits by organizing evidence, documenting control activities, tracking findings, and monitoring remediation actions.
• Assist with compliance and assessment preparation, including collecting evidence, maintaining documentation, and coordinating requests for information under the direction of senior GRC staff.
• Maintain GRC records, evidence repositories, risk registers, policy records, vendor information, and audit documentation with a high degree of accuracy.
• Assist with GRC reporting and dashboards by gathering data, updating metrics, and preparing routine reports for review by GRC leadership.
• Support security awareness and compliance training activities by maintaining training records, coordinating communications, and assisting with completion tracking.
• Assist with the administration and use of enterprise GRC tools, including workflows for risk, policy, vendor, audit, and evidence management.
• Coordinate with IT, cybersecurity, legal, procurement, and other control owners to obtain information and support compliance activities.
• Monitor assigned compliance and remediation activities and communicate overdue items or issues to the appropriate GRC team member.
• Develop working knowledge of applicable laws, regulations, contractual requirements, and cybersecurity frameworks relevant to NY Creates’ environment.
• Demonstrate critical thinking, attention to detail, dependability, and the ability to organize multiple priorities in a deadline-driven environment.
• Communicate effectively with technical and non-technical personnel and maintain professional written documentation.
• Perform other reasonable duties as assigned.

Requirements

• Two to three years of experience in governance, risk management, cybersecurity, compliance, information technology, audit, or a related field; relevant internship, academic, or equivalent experience may be considered.
• Bachelor’s degree in Cybersecurity, Information Technology, Risk Management, Business Administration, Computer Science, or a related field from an accredited institution; equivalent relevant education and experience may be considered.
• Foundational knowledge of information security, risk management, compliance, or audit principles.
• Familiarity with one or more information security or compliance frameworks, such as NIST Cybersecurity Framework, NIST Special Publication 800-171, CMMC, CIS Controls, or ISO 9001.
• Ability to collect, organize, analyze, and accurately document information from multiple sources.
• Strong attention to detail and ability to manage multiple assignments and deadlines.
• Effective written and verbal communication skills, with the ability to communicate with both technical and non-technical personnel.
• Proficiency with Microsoft Office applications, including Word, Excel, Outlook, and PowerPoint.
• This position is contingent on the satisfactory completion of a background check.

Preferred Qualifications

• Experience supporting cybersecurity, GRC, compliance, audit, risk management, or information security activities in a regulated, research, technology, federal contractor, or critical infrastructure environment.
• Familiarity with NIST 800-171, CMMC 2.0, NIST CSF, CIS Controls, or other recognized cybersecurity frameworks.
• Experience with a GRC, ticketing, compliance, document management, or audit management platform.
• Experience maintaining risk registers, audit evidence, compliance documentation, policies, or remediation tracking.
• Relevant entry-level certification such as Security+, ISC2 Certified in Cybersecurity (CC), or another related cybersecurity, audit, or compliance certification.
• Familiarity with third-party/vendor risk management processes.
• Exposure to ITAR/EAR, federal contracting, CMMC, or other regulatory requirements is a plus.
• This position may require annual background checks.

Benefits

• Medical, Vision, and Dental coverage.
• Competitive pay and paid time off.
• Flexible Health Spending and Dependent Care Accounts.
• Basic and Optional Life Insurance.
• Post-Retirement Health Insurance.
• Employer contribution of 7% of earnings to a Basic Retirement plan after meeting one year of service.
• Optional employee-contributed retirement account.