Contract Information Security GRC Analyst

Job Description Overview We don't simply hire employees. We invest in them. When you work at Chatham, we empower you — offering professional development opportunities to help you grow in your career, no matter if you've been here for five months or 15 years. Chatham values people, teamwork, integrity, and client service. You will have opportunities to partner with subject matter experts, work on complex projects, and contribute to the value Chatham delivers daily. This role sits within the Information Security Governance, Risk and Compliance (GRC) team, which reports directly into the CISO organization. The GRC team manages the enterprise's security risk posture, ensures regulatory compliance, and maintains the policy and control framework that governs information security across Chatham. The team works cross-functionally with Product and Technology, Human Resources, Operations, and all Chatham business units to embed security into development, infrastructure, and business processes; aligns with Operational Risk; and serves as the primary liaison to external auditors for SOC 2, regulatory examinations, and other assurance activities. Your role In this role you will The Information Security GRC Analyst with a Risk and Policy focus is responsible for assisting in the execution of the organization\'s security risk management program and supporting policy governance. This role leads the security risk assessments for Chatham systems, vendors, and business processes. It is responsible for maintaining the technology and cybersecurity risks on the operational risk register; tracking issues and risk mitigation activities; and supporting policy development. This role also translates technical risks into business-relevant recommendations, recommends risk-based decisions, documents decisions on risk treatment, tracks risk mitigation action plans to completion, and reviews systems and processes for policy compliance. Responsibilities Risk Assessment Execution: Conduct technology and security risk assessments for internal systems, product and technology projects using established frameworks (NIST SP 800-30, ISO 27005, etc.). Technology and Cybersecurity Risk Register Management: Maintain the technology risk register (including cybersecurity) documenting threats, vulnerabilities, impacts, likelihood, risk ratings, and treatment decisions; ensure updates with stakeholder input. Technology and Cybersecurity Risk Mitigation Tracking: Document risk treatment plans with action items, responsible parties, and target dates; track remediation progress; verify risk reduction upon closure. Technology and Cybersecurity Policy Support: Support policy lifecycle activities including drafting, review, and updates; ensure policies align with industry standards such as NIST, ISO 27001, etc. Cybersecurity and Information Security Risk Metrics: Develop and report risk metrics and KRIs; analyze trends in risk posture; identify systemic issues requiring management attention. Technology and Cybersecurity Risk Reporting/Communication: Translate technical risk findings into business-relevant language; prepare risk summaries for management review and decision-making. Stakeholder Engagement: Partner with control owners, system owners, product teams, technology teams, and business stakeholders to identify and assess risks throughout the system lifecycle. Your impact and collaboration Success in this role requires strong collaborative relationships across Chatham. The GRC Analyst partners with the Manager of Information Security GRC and Information Security leadership to align risk priorities with security strategy. The analyst interacts with technology and information security control owners to ensure controls are properly designed, implemented, and monitored. The analyst engages with Operational Risk to integrate technology and cybersecurity risks into the operational risk framework and reporting. Collaboration with external auditors during SOC 2 and regulatory examinations validates that risk management practices meet industry standards and client expectations. Qualifications Bachelor\'s degree, preferably in Information Security, Computer Science, Risk Management, or related field. 3-5+ years of experience in IT audit, IT risk management, executing security assessments, or related Technology, IT Audit or Data Governance roles. Experience in supporting/coordinating company SOC 2 Trust Services Criteria audits or conducting SOC 2 audits. Experience conducting technology and security risk assessments using NIST, ISO 27005, or similar methodologies. Strong understanding of cybersecurity risks and mitigation strategies with practical experience in threat modeling, vulnerability analysis, and risk quantification. Knowledge of security frameworks: NIST CSF, NIST 800-53, ISO 27001, CIS, SOC 2 Trust Services Criteria, Cloud Control Matrix (CCM). Knowledge of third-party security assessments and/or data protection/impact assessments. Excellent analytical and written communication skills. Certifications preferred: CRISC, CDPSE, CISA, CISSP, ISO 27001 Lead Auditor/Lead Implementer. Other certifications considered: CGEIT, CCSK, CompTIA Security+, CompTIA CySA+, CISSP-Associate, GIA/C/GSEC, PMP/CAPM, AWS Cloud Practitioner, Azure Cloud Practitioner. Note: This is a contract position working 40 hours a week. About Chatham Financial Chatham Financial is a leading independent capital markets advisor, delivering expert advice and technology to help you reduce risk and seize opportunity. Our platform unifies data across assets, debt, and derivatives for agility, transparency, and insight. We are committed to carrying that excellence into every partnership, solution, and market we serve. We guide the way, helping clients move forward with confidence. #J-18808-Ljbffr Chatham Financial