Infotech® is seeking a GRC Analyst to run the day-to-day work of our SOC 2 Type II and GovRAMP programs, partnering with engineering, IT, and business teams to collect evidence, document controls, and close gaps.
Who we are
If you’re driving on a highway in North America, there’s a good chance Infotech software helped build it. In the U.S., 88% of state transportation agencies use Infotech-developed software to manage road construction. From digital bidding to secure document signing, from cost estimation to inspection, we build tools that streamline infrastructure project delivery and ensure transparency, quality, and compliance. We’re proud to be a Certified™ Great Place to Work ® , with a people-first culture, outstanding employee retention, and flexible work-life support. Headquartered in Gainesville, Florida, Infotech is a pioneer in civil construction software and a vibrant community of technologists, collaborators, and problem solvers.
What you’ll do
State DOTs, local agencies, and contractors rely on Infotech software to deliver public infrastructure. Our Security & Compliance (GRC) team, part of Platform Engineering, keeps that trust measurable by maintaining SOC 2 Type II and GovRAMP programs across our products, including AASHTOWare Project Hosting Services (APHS). As the GRC Analyst, you run the day-to-day work of those programs and work with engineering, IT, and business teams to collect evidence, document controls, and close gaps. You will:
- Own SOC 2 Type II evidence collection and readiness each audit cycle, from the request list through auditor delivery.
- Support GovRAMP assessments for APHS, including evidence packages, the POA&M, and continuous monitoring deliverables.
- Draft and maintain security policies and control narratives aligned with SOC 2 and NIST SP 800-53 Rev 5.
- Administer Vanta and automate evidence collection to reduce manual work for engineering teams.
- Perform risk and third-party assessments, and verify that technical controls in AWS operate as documented.
- Coordinate penetration tests, track findings to closure, and own the customer security questionnaire process.
- Provide backup coverage for audit and assessment activity as directed.
- This role has no direct reports.
- You will assign and follow up on compliance tasks