GRC Analyst

GRC Analyst Sargent & Lundy is seeking a detail-oriented, organized, and data-driven GRC Analyst to support the Governance, Risk, and Compliance (GRC) team with a primary emphasis on client contract cybersecurity obligations and client assurance. Working under the direction of the Senior GRC Analyst, you will analyze client contracts for cybersecurity terms, coordinate responses to client security assessments, and help organize and track contractual obligations to make sure they are met. You will contribute to keeping obligation status visible to executives through strong data analysis and dashboard reporting. You will also support security awareness training content and delivery, including Hoxhunt phishing campaigns, support third-party vendor and software risk assessments, and support NIST 800-171 and ISO 27001 audit and compliance tracking. You will take ownership of your assigned tasks and projects, while the Senior GRC Analyst retains overall accountability for GRC program areas. Essential duties and responsibilities for the GRC Analyst include, but are not limited to: Analyze client contracts for cybersecurity terms Review client contracts, MSAs, terms and conditions, and flow-down clauses for cybersecurity, data protection, incident notification, audit rights, and regulatory requirements (e.g., NIST 800-171, DFARS, CEII). Identify gaps against S&L practices and support the Senior GRC Analyst in advising Legal and Contracts on positions and exceptions. Coordinate client security assessment responses Support intake and tracking of client security questionnaires, due diligence requests, and client audits, and drive assigned responses to on-time completion. Coordinate input from subject matter experts across Information Security, IT, Legal, and business teams, and help maintain a library of approved standard responses and supporting evidence. Support contract obligation tracking Help maintain the Information Security contract obligation tracker; record owners, due dates, and evidence requirements; follow up on obligations through completion; and flag at-risk or overdue items to the Senior GRC Analyst. Contribute to executive obligation reporting Build and maintain dashboards (e.g., Power BI, Excel) that show obligation status, upcoming deadlines, client audit rights, assessment volume and turnaround, and risk trends. Prepare data and insights that support executive-ready reporting. Support security awareness and training Help develop training content and communications, support training delivery, and help execute Hoxhunt phishing simulation campaigns. Analyze results and contribute to trend reporting to improve effectiveness. Support TPRM vendor and software assessments Contribute to the Third-Party Risk Management (TPRM) program by conducting assigned risk reviews of third-party vendors and software intake requests. Evaluate security questionnaires, SOC reports, and certifications; recommend risk tiers; and track findings and remediation through closure in partnership with Procurement. Support NIST 800-171 and ISO 27001 audit and compliance tracking Coordinate evidence collection, track control status, findings, POA&Ms, and corrective actions, and support internal and external audit activities. Risk assessment and use of GRC platforms Conduct risk assessment for existing and new information assets including but not limited to software assets, AI assets, cloud assets, endpoints, network and use GRC platforms (e.g., Hyperproof, ProcessUnity) to manage risks, obligations, assessments, evidence, and findings, and maintain accurate, complete data. Coordinate across functions Work with Legal, Contracts, Procurement, IT, and project teams to help embed contract security requirements into day-to-day operations. Contribute to process improvement Help standardize templates, playbooks, and workflows, and support automation that reduces manual effort and improves response times. Own assigned tasks and projects Take ownership of assigned tasks and projects, manage them through completion, and keep the Senior GRC Analyst informed of status, risks, and blockers. Core areas of responsibility for the GRC Analyst include, but are not limited to: Client Contract Cybersecurity Review and Obligation Tracking. Client Security Assessments Questionnaire, due diligence, and client audit response coordination. Metrics & Management Reporting Contributing to obligation tracking and executive dashboards, with a strong emphasis on data analysis. Third Party Risk Management Supporting vendor and software assessments, risk tiering, and findings tracking. Compliance Management Supporting NIST 800-171 and ISO 27001 audit and compliance tracking. Security Awareness & Training Supporting content, delivery, and phishing simulations (Hoxhunt). Supporting Government Contract Compliance Reviews and Tracking. Coordination with Legal, Contracts, Procurement, IT, and Business Teams. Security & GRC Tools GRC/TPRM platforms: Hyperproof, ProcessUnity (or similar). Data analytics and reporting Power BI and Excel (dashboards and executive reporting). This position offers the flexibility of a hybrid schedule with the expectation of 3 days per week in our downtown Chicago office, and 2 days remote from home. Qualifications Required skills: Bachelor's degree in information systems, cybersecurity, business, or a related field; or equivalent professional experience. 3–5 years of experience analyzing contracts for cybersecurity terms and coordinating responses to client security assessments. Experience with the ISO 27001 framework (ISMS requirements, Annex A controls, and audit support). Proven ability to organize, track, and drive a high volume of obligations and deadlines to completion with strong attention to detail. Data analysis skills, with the ability to build and maintain dashboards (e.g., Power BI, Excel) and prepare executive-ready reporting. Strong written and verbal communication skills, with the ability to explain contract requirements in plain language to technical and business stakeholders. Preferred skills: 3–5 years of experience performing third-party vendor and software risk assessments. Experience with GRC tools such as Hyperproof, ProcessUnity, or similar platforms. Experience supporting government work or government contracts, including NIST 800-171 requirements. Experience supporting security awareness programs or phishing simulation platforms (e.g., Hoxhunt). We do not sponsor employees for work authorization in the U.S. for this position. Technology & Innovation Sargent & Lundy values the appropriate use of technology to improve how work gets done and deliver high-quality outcomes for our clients. Depending on the role, employees may use data, automation, artificial intelligence, and other digital tools to support research, analysis, engineering and design activities, workflow improvement, or other aspects of their work. We value candidates who demonstrate an interest in learning and effectively using emerging technologies where relevant to their role. Experience with AI, automation, programming, or similar technologies is valued where relevant but is not required unless specifically identified elsewhere in the job description. About Sargent & Lundy At Sargent & Lundy, we care about the health and well-being of our employees. Our CEO Group