GOVERNANCE, RISK, AND COMPLIANCE ANALYST (GRC)

THIS POSITION IS OPEN FOR ONLY CURRENT ARIZONA RESIDENTS

JOB TITLE: GOVERNANCE, RISK, AND COMPLIANCE ANALYST (GRC)

Client: State of Arizona - AZDES - DTS

Job ID: 10482

Role: Hybrid

Contract: Until 08/10/2026 ( contract to hire )

Location: Phoenix, AZ 85007

Closing: 3/30/2026

This is a 4-month contract to hire. All candidates must be eligible to convert to an FTE. T

Required Skills

• NIST 800-53R5 (Must have)
• Risk Management Framework (RMF)
• Windows/Unix experience

Preferred Skills

• Project Management experience
• CISSP, CCSP, GSTRT, GSNA, or CAP certification

Job Summary:

The Department of Economic Security, Division of Technology Services is seeking an experienced and highly motivated individual to join our team as a Information Security Analyst, (ISA) contractor. This position will work on the Governance Risk and Compliance (GRC) Team to communicate and engage with business units to develop a strong understanding of their reporting, data, and product needs. The team member will work with other personnel across departments to define requirements for projects, identify data dependencies and relationships to develop logical and physical data models, data flows and system activity diagrams, and write specifications for managing enterprise information policies. The team member will help develop plans and materials to support user adoption, training, and customer service, working through direct and regular contact with users from other divisions, programs, and service units to provide regular insight and guidance in prioritizing enhancements for the data systems. The team member will also support technical project managers to ensure that all aspects of the information analysis and requirements gathering process are completed with the highest degree of accuracy and quality, which includes developing and socializing key project artifacts.

The state of Arizona strives for a work culture that affords employees flexibility, autonomy, and trust. Across our many agencies, boards, commissions, many State employees participate in the State's Remote Work Program and are able to work remotely in their homes, in offices, and in hoteling spaces. All work, including remote work, should be performed within Arizona unless an exception is properly authorized in advance.

Job Duties:

• Perform risk assessments, audit reviews, generate findings reports, and make appropriate recommendations for improvement and track outcomes from those activities for DES reporting requirements. Develop and formulate comprehensive reports detailing the findings, areas of non-compliance, required POA&Ms (Plan of Action and Milestones), environmental observations, and incident reports.

• Review, update, and manage security related audit plans, security plans and risk plan documentation for accuracy and consistency, proactively solves problems.

• Evaluate data and formulate comprehensive reports detailing the findings, areas of non-compliance, required action plans, and environmental observations. Generates incident reports and investigates suspicious network activity.

• Preparing audit documentation that supports audit results, drafting and editing audit findings to adhere to the standards and the agency's writing style.

• Research agency and industry IT security practices standards, best practices, laws and regulations, and other applicable resources, ensures compliance with standards

Knowledge, Skills & Abilities

• Knowledge of security principles, policies, and procedures, and be able to develop effective security policies.

• Knowledge of Information Security Risk Management.

• Knowledge of laws, regulations, policies, principles, and ethics as they relate to cybersecurity and privacy. (Required: NIST 800-53 R5, IRS Pub1075, IPAA/HITRUST, CJIS and MARS-E)

• Expert knowledge of internal auditing, internal controls, and risk management practices and methods.

• Knowledge of Selection/Approval, Implementation, and Assessment/Audit of Security and Privacy Controls.

• Knowledge of Risk Management Framework (RMF) requirements.

• Knowledge of Authorization/Approval of Information Systems.

• Knowledge in conducting audits or reviews of technical systems.

• Knowledge in comprehensive understanding of internal control environments within the IT function.

• Knowledge in multiple technology domains including aspects of Windows, Unix and/or database administration, software development and networking.

• Knowledge in identifying cybersecurity and privacy issues that stem from connections with internal and external customers and partner organizations.

• Ability to produce high quality work products for both the IT groups and Senior Management.

• Ability to perform excellent interpersonal, written and oral communication skills.

• Ability to assess, manage, and improve security policies and procedures.

• Ability to work collaboratively in teams and across organizations.

• Ability to synthesize feedback and adjust plans accordingly, build strong relationships inside and outside the organization and manage large teams.

• Ability to ensure security practices are followed throughout all phases of the life cycle of every aspect of business and IT processes.

• Ability to develop policy, plans, and strategy in compliance with laws, regulations, policies, and standards in support of organizational cyber activities.

• Ability to exercise judgment when policies are not well-defined.

• Ability to ensure information security management processes are integrated with strategic and operational planning processes.

• Ability to ensure that senior officials within the organization provide information security for the information and systems that support the operations and assets under their control.

• Ability to understand technology, management, and leadership issues related to organization processes and problem solving.

• Ability to understand the basic concepts and issues related to cyber and its organizational impact. Develop plans and materials to support user adoption, training, and customer service.

• Ability to work collaboratively in teams and across organizations.

• Develop plans and materials to support user adoption, training, and customer service.

• Work directly with users from other divisions, programs, and service units to provide insight and guidance.

• Identify risks and suggest improvements to information systems and processes.

• Support technical project managers to fulfill information analysis requirements with the highest degree of accuracy and quality.

• Develop and maintain key project artifacts.

Compensation: $46.00 per hour


About SR International INC

SR International has been a leading name among the IT consulting companies with offices in US and India. For past 16 years, our industry experience and domain knowledge have enabled us to provide innovative solutions to our customers.

Who We Are
We Are Leading IT Based Solution Providers

Today, the world of business information represents the realization of our collective efforts toward improving the future. Held only by the limits of our imagination, the business world is accelerating at an ever-increasing pace. Imagine a better way of doing business, of implementing the perfect software, of refining practice or business integration. All it takes are benchmark standards in service, support, and technical know-how, which have been our bread and butter.

Our Vision

Established in 2002, SR International Inc is one of the fastest growing and reputed provider of Information Technology Services and Solutions in the USA. Since our inception, we have been a trusted IT partner for our clients. We take pride in our highly skilled IT Resources and unique engagement model. We have been consistently delivering on our promises as a high-performance team. Our expertise in Cloud Computing, Mobility, Web Technologies, ERP and CRM are second to none. Our industry-leading flagship product iMathSmart is re-defining math learning experience for school students.

Career At SR International

At SR International, we treat our consultants like family. Our business and our reputation have been built and maintained by quality resources working onboard, so it's important for us to maintain the quality resource pool.