Contract Information Security GRC Analyst

Overview Information Security Governance, Risk and Compliance (GRC) Analyst – Risk and Policy focus. Responsibilities Assist in the execution of the organization’s security risk management program and support the policy governance lifecycle. Lead the execution of security risk assessments for Chatham systems, vendors, and business processes using frameworks such as NIST SP 800-30 and ISO27005. Maintain the technology and cybersecurity risk register, documenting threats, vulnerabilities, impacts, likelihoods, risk ratings, and treatment decisions. Track risk mitigation activity plans, ensure remedial actions are completed, and verify risk reductions upon closure. Support policy lifecycle activities including drafting, reviewing, and updating policies to align with industry standards (NIST, ISO27001, etc.). Develop and report risk metrics and KRIs, analyze trends in risk posture, and identify systemic issues that require management attention. Translate technical risk findings into business‑relevant language, prepare risk summaries for management review, and assist in stakeholder communication. Partner with control owners, system owners, product teams, technology teams, and business stakeholders to identify and assess risks throughout the system lifecycle. Collaborate closely with Operational Risk to integrate technology and cybersecurity risks into the operational risk framework and reporting. Work with external auditors during SOC2 and regulatory examinations to validate that risk management practices meet industry standards and client expectations. Qualifications Bachelor’s degree, preferably in Information Security, Computer Science, Risk Management, or a related field. 3‑5+ years of experience in IT audit, IT risk management, executing security assessments, or a related Technology/IT Audit/Data Governance role. Experience supporting or coordinating SOC2 Trust Services Criteria audits or conducting SOC2 audits. Proficiency in conducting technology and security risk assessments using NIST, ISO27005, or similar methodologies. Strong understanding of cybersecurity risks, mitigation strategies, threat modeling, vulnerability analysis, risk quantification, and follow‑through. Knowledge of security frameworks such as NIST CSF, NIST800‑53, ISO27001, Center of Internet Security (CIS), SOC2 Trust Services Criteria, and Cloud Control Matrix (CCM). Experience with third‑party security assessments and/or data protection/impact assessments. Excellent analytical and written communication skills. Preferred certifications: CRISC, CDPSE, CISA, CISSP, ISO27001 Lead Auditor/Lead Implementer. Other certifications considered: CGEIT, CCSK, CompTIA Security+, CompTIA CySA+, CISSP‑Associate, GIAC/GSEC, PMP/CAPM, AWS Cloud Practitioner, Azure Cloud Practitioner. Contract Information This is a contract position working 40 hours a week. #J-18808-Ljbffr CFC- Chatham Financial Corporation