GRC Analyst

Role Overview Join the Information Security team as a GRC Analyst, responsible for the processes, documentation, and cross-functional coordination that keep our compliance posture current and our risk exposure understood. This role is the operational engine of NMC2's security governance program. You will work closely with Engineering, Product, Legal, and Operations, acting as the connective tissue between technical teams and the governance structures that protect the business. What You Will Do You will run the security change management review process, conduct risk and vendor assessments, maintain the enterprise risk register, and own the lifecycle of NMC2's security policy library. Day-to-day, you will work closely with Engineering, Product, Legal, and Operations. Why It Might Be a Fit The right person for this role is equally at home authoring a policy document, running a risk workshop with a product team, and producing a clean risk summary for the CISO. You bring strong judgment about where governance adds real value, and you know how to design processes that people actually follow. Requirements Bachelor's degree in Information Systems, Computer Science, Business Administration, or a related field — or equivalent experience. 4–8 years of experience in GRC, information security governance, compliance, or risk management. Hands-on experience owning or significantly contributing to security change management, risk assessment, or policy management processes. Working knowledge of at least two major security frameworks or standards — ISO 27001, SOC 2 TSC, NIST CSF, NIST SP 800-53, or CIS Controls. Experience developing, reviewing, and publishing information security policies, standards, and procedures. Familiarity with risk register management: identifying, rating, tracking, and reporting on information security risks. Experience with GRC or compliance automation platforms such as ServiceNow GRC, Vanta, Drata, Hyperproof, or Archer. Proficiency with project and workflow tools (Jira, Confluence, or similar) for change tracking, risk registers, and policy workflows. Strong written communication skills with the ability to translate technical security requirements into clear, accessible policy language for a non-technical audience. Collaborative working style with demonstrated experience engaging stakeholders across Engineering, Legal, HR, and Operations. One or more relevant certifications preferred: CISM, CRISC, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, or CompTIA Security+. Benefits Company-Paid Lunch Stipend Company-Paid Benefits: 100% Employer-Paid Medical in our High Deductible Health Plan, Dental and Vision benefits for employees and their families, 16 weeks of Paid Parental Leave, Employee Assistance Program, Life insurance, Short-Term Disability and Long-Term Disability 401(k): Company will match 100% of your contributions up to 6% Optional Employee-Paid Benefits: Medical insurance in our PPO plan and a variety of other benefits such as Health Savings Accounts (with Company Contribution!), Flexible Spending Accounts, Supplemental Life Insurance, Wellhub and more. Time Off: 25 days of Paid Time Off plus 12 company holidays #J-18808-Ljbffr