Sr. GRC Analyst

Type: Contract-to-HireCategory: Information TechnologyReference ID: 10081639Job record: a1qPL000008IyU9YAKValid through: 2027-09-15Senior GRC Analyst Industry: Professional Services / Information SecurityLocation: Chicago, ILWork Schedule: Hybrid – Onsite Monday, Wednesday & ThursdayAssignment Type: Contract-to-HireStart Date: ASAPPay: $115,000-$125,000About the OpportunityOur client, a national professional services organization, is seeking a Senior Governance, Risk & Compliance (GRC) Analyst to help build and mature its internal Information Security GRC program.This is a net-new position within an evolving security organization. The environment is still developing from a GRC process and tooling perspective, so this is an opportunity for someone who enjoys building—not simply maintaining an already mature compliance program.The Senior GRC Analyst will play a hands-on role across SOC 2, enterprise risk management, security risk assessments, policy management, NIST Cybersecurity Framework (CSF), audit readiness, remediation tracking, and executive reporting.The ideal candidate is a hands-on problem solver who can walk into an environment where every process or tool may not yet exist, identify what needs to improve, and develop practical solutions.This is a senior individual-contributor position with no direct reports. The Senior GRC Analyst will also provide guidance and mentorship to another GRC resource while working closely with senior Information Security leadership.Key ResponsibilitiesSOC 2, Compliance & AuditHelp strengthen and drive the organization's SOC 2 compliance and readiness program.Coordinate audit requests, evidence collection, and control-owner responses.Perform or coordinate control testing and validation.Identify control deficiencies and compliance gaps.Track audit findings and corrective actions through closure.Partner with control owners to develop practical remediation plans.Coordinate directly with auditors and internal stakeholders throughout compliance activities.Improve the overall structure and sustainability of the SOC 2 program.Enterprise Risk ManagementEstablish and maintain the enterprise information security risk register.Lead security risk assessments across the organization.Perform control-gap analyses and security maturity assessments.Identify, analyze, document, and prioritize security risks.Develop risk-treatment and remediation plans.Manage risk acceptance and security exceptions.Identify and document compensating controls.Track remediation activities through completion.Translate technical security risks into clear, business-focused recommendations for leadership.Governance & NIST CSFHelp operationalize the organization's information security governance program using NIST CSF 2.0.Apply NIST CSF to risk assessments, governance processes, controls, policies, and maturity evaluations.Maintain governance calendars, control assessments, risk reviews, and reporting cycles.Establish clear ownership and accountability for security controls.Identify systemic control gaps and opportunities to improve the overall security program.Help translate security frameworks into practical processes that can be consistently executed across the organization.Policy ManagementOwn and improve the information security policy lifecycle.Develop, review, update, and maintain security policies, standards, and procedures.Coordinate policy review and approval processes.Maintain policy publication, version control, and evidence retention.Map policies, standards, and procedures to NIST CSF 2.0 and applicable compliance requirements.Maintain policy exceptions and residual-risk documentation.Help ensure security policies are operationalized rather than simply documented.Reporting & Program ImprovementDevelop GRC dashboards, metrics, KRIs and KPIs.Provide leadership with clear reporting on: Enterprise security riskSOC 2 readinessCompliance statusPolicy governanceRemediation progressIdentify weaknesses in existing GRC processes and develop practical improvements.Help establish repeatable, scalable GRC processes where formal processes or tooling may not yet exist.Drive multiple GRC initiatives simultaneously using a strong project-management mindset.The position owns key activities spanning risk assessments and the risk register, policy lifecycle management, SOC 2, security exceptions, remediation, reporting, and NIST CSF governance.Required Qualifications5+ years of experience in Information Security, GRC, IT Risk, Security Compliance, Audit, or a related discipline.Strong hands-on experience with SOC 2 compliance and readiness.Experience taking meaningful ownership of SOC 2 activities—not solely collecting audit evidence.Experience coordinating controls, evidence, findings, remediation, and audit activities.Demonstrated experience leading security risk assessments.Experience identifying and evaluating control gaps.Hands-on experience developing and maintaining risk registers.Experience developing risk-treatment and remediation plans.Ability to drive identified risks and remediation items through closure.Strong experience developing, reviewing, and maintaining information security policies, standards, and procedures.Practical experience applying NIST Cybersecurity Framework (NIST CSF).Experience performing security maturity and/or gap assessments.Demonstrated ability to operate successfully within an evolving or immature GRC environment.Ability to create effective processes when mature tools or established workflows do not already exist.Strong project-management and organizational skills.Ability to manage multiple concurrent GRC initiatives.Strong analytical and problem-solving capabilities.Excellent written and verbal communication.Ability to communicate effectively with technical teams, non-technical business stakeholders, and senior leadership.Bachelor's degree in a relevant discipline or equivalent practical experience.The formal qualifications specifically call for hands-on SOC 2, risk assessment/risk-register ownership, policy management, practical NIST CSF application, and the ability to build solutions in an immature GRC environment.Preferred QualificationsCISACRISCCISMCISSPSecurity+ or comparable security/GRC certificationISO 27001 experienceIT General Controls (ITGC) experienceThird-party risk managementClient security questionnaires / assuranceAI governanceData protection / privacy-related security experienceSecurity awareness program experienceExperience with GRC and workflow technologies such as: AuditBoardServiceNow GRCOneTrustArcherJiraSharePointCertifications are valued, but practical GRC experience and demonstrated ownership are more important for this position.What We're Looking ForThis is not a role for someone who needs an established GRC program, mature tooling, or highly defined processes in order to be successful.The ideal candidate is comfortable hearing:"We know this needs to be better—help us figure out how to fix it."You should be able to assess the current state, identify gaps, prioritize what matters, develop a practical solution, gain stakeholder buy-in, and then drive the work through implementation.We're particularly interested in candidates who can provide specific examples of personally:Driving or significantly improving a SOC 2 programLeading a security risk assessmentBuilding or improving an enterprise risk registerIdentifying control gaps and developing remediation plansDriving remediation through closureDeveloping or restructuring security policiesApplying NIST CSF to a real-world security programBuilding GRC processes without sophisticated toolingWorking directly with auditorsCoordinating technical and business stakeholdersManaging several GRC initiatives simultaneouslyThe goal of the position is to help turn an immature GRC environment into a more structured and sustainable program across SOC 2, risk management, remediation, policy governance, and NIST CSF.Leadership & MentorshipThis is a senior individual-contributor position—not a people-management role.The Senior GRC Analyst will:Serve as a trusted GRC advisor to technical and business stakeholders.Provide guidance and mentorship to another GRC Analyst.Share GRC best practices and practical knowledge.Help improve the consistency and quality of GRC work.Partner closely with Information Security leadership.Help drive accountability across control owners and stakeholders.The position has no direct reports but is expected to provide mentorship and senior-level guidance.Core GRC Focus AreasSOC 2NIST CSF 2.0Enterprise Risk ManagementSecurity Risk AssessmentsRisk RegistersRisk TreatmentControl Gap AnalysisSecurity Maturity AssessmentsInformation Security Policy ManagementAudit ReadinessControl TestingEvidence ManagementFindings & RemediationSecurity ExceptionsCompensating ControlsKRIs / KPIsExecutive ReportingThird-Party RiskGRC Process ImprovementWork EnvironmentHybrid position based in downtown ChicagoOnsite Monday, Wednesday, and ThursdayContract-to-hireHighly visible position within the internal Information Security organizationSignificant interaction with IT, Legal, Privacy, HR, and business leadershipOpportunity to directly influence how the organization's GRC program is built and maturedAdditional DetailsNet-new positionASAP startSenior individual-contributor roleNo direct reportsTwo-step interview process: Initial video interview with Information Security leadershipFinal onsite interview with additional team stakeholdersStrong emphasis on practical experience, ownership, communication, and problem solvingBenefitsEligible consultants may receive:Medical and prescription drug coverageDental insuranceVision insuranceHealth Savings Account (HSA)Flexible Spending Accounts (FSA)Short-Term and Long-Term Disability InsuranceSupplemental Life Insurance401(k)Weekly payIf you're a hands-on Senior GRC Analyst who has personally driven SOC 2, risk assessments, policy management, remediation, and NIST CSF initiatives—and you enjoy building programs rather than simply maintaining them—apply today to learn more. Addison Group is an Equal Opportunity Employer. Addison Group provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, gender, sexual orientation, national origin, age, disability, genetic information, marital status, amnesty, or status as a covered veteran in accordance with applicable federal, state and local laws. Addison Group complies with applicable state and local laws governing non-discrimination in employment in every location in which the company has facilities. Reasonable accommodation is available for qualified individuals with disabilities, upon request.