Sr. GRC Analyst

Senior GRC Analyst

Industry: Professional Services / Information Security

Location: Chicago, IL

Work Schedule: Hybrid – Onsite Monday, Wednesday & Thursday

Assignment Type: Contract-to-Hire

Start Date: ASAP

Pay: $115,000-$125,000

About the Opportunity

Our client, a national professional services organization, is seeking a Senior Governance, Risk & Compliance (GRC) Analyst to help build and mature its internal Information Security GRC program.

This is a net-new position within an evolving security organization. The environment is still developing from a GRC process and tooling perspective, so this is an opportunity for someone who enjoys building—not simply maintaining an already mature compliance program.

The Senior GRC Analyst will play a hands-on role across SOC 2, enterprise risk management, security risk assessments, policy management, NIST Cybersecurity Framework (CSF), audit readiness, remediation tracking, and executive reporting .

The ideal candidate is a hands-on problem solver who can walk into an environment where every process or tool may not yet exist, identify what needs to improve, and develop practical solutions.

This is a senior individual-contributor position with no direct reports . The Senior GRC Analyst will also provide guidance and mentorship to another GRC resource while working closely with senior Information Security leadership.

Key Responsibilities

SOC 2, Compliance & Audit

• Help strengthen and drive the organization's SOC 2 compliance and readiness program .
• Coordinate audit requests, evidence collection, and control-owner responses.
• Perform or coordinate control testing and validation.
• Identify control deficiencies and compliance gaps.
• Track audit findings and corrective actions through closure.
• Partner with control owners to develop practical remediation plans.
• Coordinate directly with auditors and internal stakeholders throughout compliance activities.
• Improve the overall structure and sustainability of the SOC 2 program.

Enterprise Risk Management

• Establish and maintain the enterprise information security risk register .
• Lead security risk assessments across the organization.
• Perform control-gap analyses and security maturity assessments.
• Identify, analyze, document, and prioritize security risks.
• Develop risk-treatment and remediation plans.
• Manage risk acceptance and security exceptions.
• Identify and document compensating controls.
• Track remediation activities through completion.
• Translate technical security risks into clear, business-focused recommendations for leadership.

Governance & NIST CSF

• Help operationalize the organization's information security governance program using NIST CSF 2.0 .
• Apply NIST CSF to risk assessments, governance processes, controls, policies, and maturity evaluations.
• Maintain governance calendars, control assessments, risk reviews, and reporting cycles.
• Establish clear ownership and accountability for security controls.
• Identify systemic control gaps and opportunities to improve the overall security program.
• Help translate security frameworks into practical processes that can be consistently executed across the organization.

Policy Management

• Own and improve the information security policy lifecycle .
• Develop, review, update, and maintain security policies, standards, and procedures.
• Coordinate policy review and approval processes.
• Maintain policy publication, version control, and evidence retention.
• Map policies, standards, and procedures to NIST CSF 2.0 and applicable compliance requirements.
• Maintain policy exceptions and residual-risk documentation.
• Help ensure security policies are operationalized rather than simply documented.

Reporting & Program Improvement

• Develop GRC dashboards, metrics, KRIs and KPIs .
• Provide leadership with clear reporting on:
  • Enterprise security risk
  • SOC 2 readiness
  • Compliance status
  • Policy governance
  • Remediation progress
• Identify weaknesses in existing GRC processes and develop practical improvements.
• Help establish repeatable, scalable GRC processes where formal processes or tooling may not yet exist.
• Drive multiple GRC initiatives simultaneously using a strong project-management mindset.

The position owns key activities spanning risk assessments and the risk register, policy lifecycle management, SOC 2, security exceptions, remediation, reporting, and NIST CSF governance.

Required Qualifications

• 5+ years of experience in Information Security, GRC, IT Risk, Security Compliance, Audit, or a related discipline.
• Strong hands-on experience with SOC 2 compliance and readiness .
• Experience taking meaningful ownership of SOC 2 activities—not solely collecting audit evidence.
• Experience coordinating controls, evidence, findings, remediation, and audit activities.
• Demonstrated experience leading security risk assessments .
• Experience identifying and evaluating control gaps.
• Hands-on experience developing and maintaining risk registers .
• Experience developing risk-treatment and remediation plans.
• Ability to drive identified risks and remediation items through closure.
• Strong experience developing, reviewing, and maintaining information security policies, standards, and procedures .
• Practical experience applying NIST Cybersecurity Framework (NIST CSF) .
• Experience performing security maturity and/or gap assessments.
• Demonstrated ability to operate successfully within an evolving or immature GRC environment .
• Ability to create effective processes when mature tools or established workflows do not already exist.
• Strong project-management and organizational skills.
• Ability to manage multiple concurrent GRC initiatives.
• Strong analytical and problem-solving capabilities.
• Excellent written and verbal communication.
• Ability to communicate effectively with technical teams, non-technical business stakeholders, and senior leadership.
• Bachelor's degree in a relevant discipline or equivalent practical experience.

The formal qualifications specifically call for hands-on SOC 2, risk assessment/risk-register ownership, policy management, practical NIST CSF application, and the ability to build solutions in an immature GRC environment.

Preferred Qualifications

• CISA
• CRISC
• CISM
• CISSP
• Security+ or comparable security/GRC certification
• ISO 27001 experience
• IT General Controls (ITGC) experience
• Third-party risk management
• Client security questionnaires / assurance
• AI governance
• Data protection / privacy-related security experience
• Security awareness program experience
• Experience with GRC and workflow technologies such as:
  • AuditBoard
  • ServiceNow GRC
  • OneTrust
  • Archer
  • Jira
  • SharePoint

Certifications are valued, but practical GRC experience and demonstrated ownership are more important for this position.

What We're Looking For

This is not a role for someone who needs an established GRC program, mature tooling, or highly defined processes in order to be successful .

The ideal candidate is comfortable hearing:

"We know this needs to be better—help us figure out how to fix it."

You should be able to assess the current state, identify gaps, prioritize what matters, develop a practical solution, gain stakeholder buy-in, and then drive the work through implementation.

We're particularly interested in candidates who can provide specific examples of personally:

• Driving or significantly improving a SOC 2 program
• Leading a security risk assessment
• Building or improving an enterprise risk register
• Identifying control gaps and developing remediation plans
• Driving remediation through closure
• Developing or restructuring security policies
• Applying NIST CSF to a real-world security program
• Building GRC processes without sophisticated tooling
• Working directly with auditors
• Coordinating technical and business stakeholders
• Managing several GRC initiatives simultaneously

The goal of the position is to help turn an immature GRC environment into a more structured and sustainable program across SOC 2, risk management, remediation, policy governance, and NIST CSF.

Leadership & Mentorship

This is a senior individual-contributor position—not a people-management role .

The Senior GRC Analyst will:

• Serve as a trusted GRC advisor to technical and business stakeholders.
• Provide guidance and mentorship to another GRC Analyst.
• Share GRC best practices and practical knowledge.
• Help improve the consistency and quality of GRC work.
• Partner closely with Information Security leadership.
• Help drive accountability across control owners and stakeholders.

The position has no direct reports but is expected to provide mentorship and senior-level guidance.

Core GRC Focus Areas

• SOC 2
• NIST CSF 2.0
• Enterprise Risk Management
• Security Risk Assessments
• Risk Registers
• Risk Treatment
• Control Gap Analysis
• Security Maturity Assessments
• Information Security Policy Management
• Audit Readiness
• Control Testing
• Evidence Management
• Findings & Remediation
• Security Exceptions
• Compensating Controls
• KRIs / KPIs
• Executive Reporting
• Third-Party Risk
• GRC Process Improvement

Work Environment

• Hybrid position based in downtown Chicago
• Onsite Monday, Wednesday, and Thursday
• Contract-to-hire
• Highly visible position within the internal Information Security organization
• Significant interaction with IT, Legal, Privacy, HR, and business leadership
• Opportunity to directly influence how the organization's GRC program is built and matured

Additional Details

• Net-new position
• ASAP start
• Senior individual-contributor role
• No direct reports
• Two-step interview process:
  • Initial video interview with Information Security leadership
  • Final onsite interview with additional team stakeholders
• Strong emphasis on practical experience, ownership, communication, and problem solving

Benefits

Eligible consultants may receive:

• Medical and prescription drug coverage
• Dental insurance
• Vision insurance
• Health Savings Account (HSA)
• Flexible Spending Accounts (FSA)
• Short-Term and Long-Term Disability Insurance
• Supplemental Life Insurance
• 401(k)
• Weekly pay

If you're a hands-on Senior GRC Analyst who has personally driven SOC 2, risk assessments, policy management, remediation, and NIST CSF initiatives—and you enjoy building programs rather than simply maintaining them—apply today to learn more.

Addison Group is an Equal Opportunity Employer. Addison Group provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, gender, sexual orientation, national origin, age, disability, genetic information, marital status, amnesty, or status as a covered veteran in accordance with applicable federal, state and local laws. Addison Group complies with applicable state and local laws governing non-discrimination in employment in every location in which the company has facilities. Reasonable accommodation is available for qualified individuals with disabilities, upon request.