Sr. GRC Analyst
maybe under About the role or separate? The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it." So we can include location, assignment type, start date, industry in a paragraph maybe under About the role or a separate meta paragraph. But we must not create extra headings for those. We need to output only HTML fragment, no /, no markdown fences. We'll produce sections:
About the role
with paragraph(s) containing the description from About The Opportunity plus maybe location, assignment type, start date, industry.Responsibilities
with- for each bullet from Key Responsibilities (SOC 2, Compliance & Audit; Enterprise Risk Management; Governance & NIST CSF; Policy Management; Reporting & Program Improvement). We need to preserve all detail; we can break each bullet into sub-items? The original has paragraphs under each heading. We could keep them as list items with the heading as part of the item text. Eg:
- SOC 2, Compliance & Audit – Help strengthen ... etc. . That preserves detail.
- each bullet.
Qualifications
for Preferred Qualifications (list). We'll output- each bullet.
Benefits
with list from Benefits Eligible consultants may receive: ... We'll list each.Pay
with paragraph containing "$115,000-$125,000".Schedule
with paragraph containing "Hybrid – Onsite Monday, Wednesday & Thursday". Also maybe mention contract-to-hire? Could be part of schedule or about role. But schedule section only if posting actually states them; yes schedule is given. We'll include that. We must not include filler like "commensurate with experience". Not present. We must not include duplicated lines. Ensure we don't repeat. We must not include application instructions, EEO, etc. Let's extract details. About The Opportunity paragraph: "Our client, a national professional services organization, is seeking a Senior Governance, Risk & Compliance (GRC) Analyst to help build and mature its internal Information Security GRC program. This is a net-new position within an evolving security organization. The environment is still developing from a GRC process and tooling perspective, so this is an opportunity for someone who enjoys building—not simply maintaining an already mature compliance program. The Senior GRC Analyst will play a hands-on role across SOC 2, enterprise risk management, security risk assessments, policy management, NIST Cybersecurity Framework (CSF), audit readiness, remediation tracking, and executive reporting. The ideal candidate is a hands-on problem solver who can walk into an environment where every process or tool may not yet exist, identify what needs to improve, and develop practical solutions. This is a senior individual-contributor position with no direct reports. The Senior GRC Analyst will also provide guidance and mentorship to another GRC resource while working closely with senior Information Security leadership." We can include that. Add location etc maybe as separate paragraph: "Location: Chicago, IL. Work Schedule: Hybrid – Onsite Monday, Wednesday & Thursday. Assignment Type: Contract-to-Hire. Start Date: ASAP. Industry: Professional Services / Information Security." But schedule already has its own section; we could still mention location etc in About the role paragraph. Better to keep About the role paragraph focusing on description; we can add a shortafter it for metadata: "Location: Chicago, IL. Assignment Type: Contract-to-Hire. Start Date: ASAP. Industry: Professional Services / Information Security." That's minor metadata. Now Responsibilities: We need to capture all bullet points from each subheading. Let's extract: SOC 2, Compliance & Audit: - Help strengthen and drive the organization's SOC 2 compliance and readiness program. - Coordinate audit requests, evidence collection, and control-owner responses. - Perform or coordinate control testing and validation. - Identify control deficiencies and compliance gaps. - Track audit findings and corrective actions through closure. - Partner with control owners to develop practical remediation plans. - Coordinate directly with auditors and internal stakeholders throughout compliance activities. - Improve the overall structure and sustainability of the SOC 2 program. Enterprise Risk Management: - Establish and maintain the enterprise information security risk register. - Lead security risk assessments across the organization. - Perform control-gap analyses and security maturity assessments. - Identify, analyze, document, and prioritize security risks. - Develop risk-treatment and remediation plans. - Manage risk acceptance and security exceptions. - Identify and document compensating controls. - Track remediation activities through completion. - Translate technical security risks into clear, business-focused recommendations for leadership. Governance & NIST CSF: - Help operationalize the organization's information security governance program using NIST CSF 2.0. - Apply NIST CSF to risk assessments, governance processes, controls, policies, and maturity evaluations. - Maintain governance calendars, control assessments, risk reviews, and reporting cycles. - Establish clear ownership and accountability for security controls. - Identify systemic control gaps and opportunities to improve the overall security program. - Help translate security frameworks into practical processes that can be consistently executed across the organization. Policy Management: - Own and improve the information security policy lifecycle. - Develop, review, update, and maintain security policies, standards, and procedures. - Coordinate policy review and approval processes. - Maintain policy publication, version control, and evidence retention. - Map policies, standards, and procedures to NIST CSF 2.0 and applicable compliance requirements. - Maintain policy exceptions and residual-risk documentation. - Help ensure security policies are operationalized rather than simply documented. Reporting & Program Improvement: - Develop GRC dashboards, metrics, KRIs and KPIs. - Provide leadership with clear reporting on: - Enterprise security risk - SOC 2 readiness - Compliance status - Policy governance - Remediation progress - Identify weaknesses in existing GRC processes and develop practical improvements. - Help establish repeatable, scalable GRC processes where formal processes or tooling may not yet exist. - Drive multiple GRC initiatives simultaneously using a strong project-management mindset. - The position owns key activities spanning risk assessments and the risk register, policy lifecycle management, SOC 2, security exceptions, remediation, reporting, and NIST CSF governance. We'll include each as list items; for sub-bullets under Provide leadership..., we can embed as part of the item or separate items. To preserve detail, we can make separate list items for each. Now Required Qualifications list: - 5+ years of experience in Information Security, GRC, IT Risk, Security Compliance, Audit, or a related discipline. - Strong hands-on experience with SOC 2 compliance and readiness. - Experience taking meaningful ownership of SOC 2 activities—not solely collecting audit evidence. - Experience coordinating controls, evidence, findings, remediation, and audit activities. - Demonstrated experience leading security risk assessments. - Experience identifying and evaluating control gaps. - Hands-on experience developing and maintaining risk registers. - Experience developing risk-treatment and remediation plans. - Ability to drive identified risks and remediation items through closure. - Strong experience developing, reviewing, and maintaining information security policies, standards, and procedures. - Practical experience applying NIST Cybersecurity Framework (NIST CSF). - Experience performing security maturity and/or gap assessments. - Demonstrated ability to operate successfully within an evolving or immature GRC environment. - Ability to create effective processes when mature tools or established workflows do not already exist. - Strong project-management and organizational skills. - Ability to manage multiple concurrent GRC initiatives. - Strong analytical and problem-solving capabilities. - Excellent written and verbal communication. - Ability to communicate effectively with technical teams, non-technical business stakeholders, and senior leadership. - Bachelor's degree in a relevant discipline or equivalent practical experience. We'll output each as
- . Preferred Qualifications list: - CISA - CRISC - CISM - CISSP - Security+ or comparable security/GRC certification - ISO 27001 experience - IT General Controls (ITGC) experience - Third-party risk management - Client security questionnaires / assurance - AI governance - Data protection / privacy-related security experience - Security awareness program experience - Experience with GRC and workflow technologies such as: - AuditBoard - ServiceNow GRC - OneTrust - Archer - Jira - SharePoint - Certifications are valued, but practical GRC experience and demonstrated ownership are more important for this position. We'll list each as
- ; for the sublist of technologies we can embed as part of the item or separate items. Probably keep as one item with the list inside? But we need to use
- for any list of duties/requirements/benefits. So we could have a
- containing a nested
- for the technologies. That's acceptable.
Now Benefits list:
- Medical and prescription drug coverage
- Dental insurance
- Vision insurance
- Health Savings Account (HSA)
- Flexible Spending Accounts (FSA)
- Short-Term and Long-Term Disability Insurance
- Supplemental Life Insurance
- 401(k)
- Weekly pay
We'll output each as
- .
Pay: "$115,000-$125,000"
Schedule: "Hybrid – Onsite Monday, Wednesday & Thursday"
We might also include Assignment Type etc in About the role paragraph or separate
. We'll add a short
after About the role paragraph: "
Location: Chicago, IL. Assignment Type: Contract-to-Hire. Start Date: ASAP. Industry: Professional Services / Information Security.
" Now ensure we don't repeat job title. Not using. Now produce HTML fragment:About the role
Our client, a national professional services organization, is seeking a Senior Governance, Risk & Compliance (GRC) Analyst to help build and mature its internal Information Security GRC program. This is a net-new position within an evolving security organization. The environment is still developing from a GRC process and tooling perspective, so this is an opportunity for someone who enjoys building—not simply maintaining an already mature compliance program. The Senior GRC Analyst will play a hands-on role across SOC 2, enterprise risk management, security risk assessments, policy management, NIST Cybersecurity Framework (CSF), audit readiness, remediation tracking, and executive reporting. The ideal candidate is a hands-on problem solver who can walk into an environment where every process or tool may not yet exist, identify what needs to improve, and develop practical solutions
- .
Pay: "$115,000-$125,000"
Schedule: "Hybrid – Onsite Monday, Wednesday & Thursday"
We might also include Assignment Type etc in About the role paragraph or separate
- each bullet.