Note: The job is a remote job and is open to candidates in USA. Infotech is seeking a GRC Analyst to run its SOC 2 Type II and GovRAMP programs. The role partners with engineering, IT, and business teams to collect evidence, document controls, assess risks, and close compliance gaps.
Responsibilities
- Own SOC 2 Type II evidence collection and readiness each audit cycle, from the request list through auditor delivery
- Support GovRAMP assessments for APHS, including evidence packages, the POA&M, and continuous monitoring deliverables
- Draft and maintain security policies and control narratives aligned with SOC 2 and NIST SP 800-53 Rev 5
- Administer Vanta and automate evidence collection to reduce manual work for engineering teams
- Perform risk and third-party assessments, and verify that technical controls in AWS operate as documented
- Coordinate penetration tests, track findings to closure, and own the customer security questionnaire process
- Provide backup coverage for audit and assessment activity as directed
- You will assign and follow up on compliance tasks with control owners in other teams
Skills
- 5+ years of experience in GRC, security compliance, or IT audit
- Ownership of at least one full SOC 2 Type II audit cycle or GovRAMP assessment, from readiness through remediation
- Experience writing security policies and control documentation
- The ability to coordinate deliverables across several teams and keep work moving without close direction
- Familiarity with policy as code, such as defining and testing controls with Open Policy Agent, AWS Config rules, or infrastructure-as-code policy checks
- Clear communication with auditors, engineers, and executives
- The ability to lead, investigate, and coordinate security incidents
- This role is not sponsorship eligible
- Experience supporting GovRAMP, StateRAMP, or FedRAMP programs, including POA&M management or continuous monitoring
- A good understanding of cloud security policies
- A certification such as CGRC, CISA, CISSP, CISM, or Security+
- Experience with government or other contract-driven customers
- Administration of Vanta, Drata, or a similar compliance platform
- The ability to read AWS configuration evidence and know what good looks like
- Experience automating compliance work with scripts or APIs
Benefits
- Fully remote within the US
- Comprehensive health benefits
- Inclusive wellness support
- Flexible time off
- Paid holidays
- Continuing education and leadership development programs
- An inclusive culture built on empathy, connection, and trust
Company Overview