Senior IT GRC Analyst
About the role
The Senior IT GRC Analyst leads policy development and audit execution within CMG's IT Governance, Risk, and Compliance program, with particular emphasis on CMG's upcoming SOC 2 readiness effort. This role works closely with the GRC team and the broader IT department to plan and execute audit engagements, maintain the policy framework, and manage auditor relationships. The Senior IT GRC Analyst operates with a high degree of autonomy and is expected to navigate ambiguity in a regulated environment.
The role is based in an ADA‑compliant office environment, using typical office equipment and computer‑based tasks; it may involve periods of stationary work and moving throughout the day, with flexibility to work overtime to meet project deadlines. The position is remote, open to candidates located in geographic regions that do not currently require base wage disclosure; residents of CA, CO, and NY are excluded from consideration at this time. Compensation details will be provided upon request.
Responsibilities
- Lead CMG's SOC 2 readiness assessment, including scope definition, gap analysis, and control design, in partnership with the IT GRC Manager.
- Serve as a point of contact during audit engagements and regulatory exams.
- Develop, maintain, and update IT