Information Security Governance, Risk and Compliance Analyst

Information Security Governance, Risk and Compliance Analyst (JN -View phone number on click.appcast.io) Boston, Massachusetts Salary: USD50 - USD54.05 per hour We are seeking an Information Security Governance, Risk and Compliance Analyst to work for our company (Ultimate Staffing is a division of Roth Staffing) on a project for a client, who is based in Boston, MA. No 3rd party candidates can be considered for this position. Pay Rate: $50.00/hr. - $54.05/hr. Location : Boston - Pier 4; hybrid in office 2-3 days per week. Expected Work Scheduled/Hours: Mon thru Fri 8am-5pm EST Interview Schedule: 3 rounds total; 2 virtual, 1 on-site. Initial 30min screen and detailed 1 hour follow-up with HM. 1 hour final on-site with HM Ass. Director. Role Summary The Information Security Governance, Risk and Compliance Analyst supports execution of the Governance, Risk and Compliance program across the US affiliate. Reporting to the Senior Manager, Information Security Governance Risk and Compliance, this role is responsible for performing information security risk assessments, third-party security reviews, policy administration, control assurance, compliance support, remediation tracking, and operational reporting. The position works closely with IT, Legal, Privacy, Procurement, Quality, Internal Audit, business stakeholders, and Global Information Security to ensure information security risks are identified, documented, communicated, and managed in alignment with enterprise requirements. This role contributes to the development of repeatable governance, audit readiness, and risk management capabilities as the US Information Security function continues to mature. The successful candidate will bring strong analytical judgment, attention to detail, and the ability to translate risk and control information into clear documentation that supports informed decision making. Primary Responsibilities Perform information security risk assessments across applications, infrastructure, business processes, projects, and third parties Support maintenance of the US information security risk register, risk treatment plans, remediation status, and supporting evidence Execute third-party security reviews and vendor risk assessments in partnership with Procurement, Legal, Privacy, and business stakeholders Support lifecycle management of information security policies, standards, procedures, guidelines, attestations, and exceptions Collect, validate, and organize compliance and control evidence for internal audits, external audits, regulatory inspections, and assurance activities Track remediation plans and coordinate follow-up activities with risk owners, control owners, and cross-functional stakeholders Support control assessments and control effectiveness reviews against information security policies, standards, and regulatory requirements Maintain governance, risk, and compliance documentation, repositories, metrics, dashboards, and reporting artifacts to support management visibility Assist with preparation of executive reporting materials, governance committee content, and risk review documentation Identify opportunities to improve GRC processes through standardization, automation, documentation quality, and repeatable workflows Education and Required Skills Minimum of 3 years of experience in information security, cybersecurity governance, IT risk management, compliance, audit, or related disciplines Bachelor's degree preferred in Cybersecurity, Information Technology, Information Systems, Business, Risk Management, or a related field Working knowledge of cybersecurity and risk frameworks such as NIST CSF 2.0, ISO 27001, CIS Controls, PCI, SOX, FAIR, or similar standards Experience supporting risk assessments, compliance reviews, audits, control assurance, third-party reviews, or remediation tracking Strong written communication skills with the ability to develop clear documentation, reports, procedures, and stakeholder-ready materials Strong analytical and organizational skills with attention to detail and the ability to manage multiple priorities Relevant certifications such as Security+, GSEC, SSCP, CISA, CRISC, or similar certifications preferred Travel and Location Travel and Location Estimated travel required: 0-5% On-site in Boston preferred 1-2 days hybrid or 100% remote with occasional travel to Boston #J-18808-Ljbffr Ledgent Technology