Security Governance Risk & Compliance (GRC) Analyst

Virtru develops data protection applications and an open platform that enables secure, privacy-preserving data sharing. The Security Governance Risk & Compliance (GRC) Analyst will lead CMMC compliance efforts, conduct gap analyses, and support FedRAMP, SOC 2, and PCI DSS compliance while managing controls, risk assessments, automation, incident response, and vendor security reviews.

Responsibilities:

• Manage and implement complex controls frameworks for large systems, consisting of Cloud infrastructure and Software as a Service (SaaS) services (GCP, AWS, GitHub, Okta, etc)
• Design and develop automation solutions for evidence collection across Cloud infrastructure, endpoints, and SaaS services
• Conduct risk assessments across business units and processes. Identify risk findings and recommend remediation and risk mitigation strategies
• Participate in incident response (IR) activities, providing risk analysis and remediation support as needed
• Assist or implement automated controls to support risk mitigation efforts across various business units with stakeholders
• Incorporate CMMC certification into Virtru’s slate of compliance assessments and ongoing monitoring activities (FedRAMP, SOC 2, PCI)
• Facilitate the third-party vendor on-boarding and annual review process by evaluating the security of current and prospective partners
• Enhance the team with your individualism, spirit, and love of learning

Requirements:

• Minimum of 5+ years of information security, IT audit and/or IT Risk Management, or GRC Analyst/Engineer experience
• Deep understanding of FedRAMP along with at least few of the following: CMMC, NIST 800-53 & 800-171, SOC 2, PCI, and/or other global privacy compliance frameworks
• Technical acumen. Strong understanding of modern cloud technologies (AWS, GCP, Azure, etc.) and familiarity with GRC tools (Hyperproof, Vanta, Drata, etc) and SIEM tools (Datadog, Splunk)
• You're a relationship builder and have worked with both business and technical risk and understand how to translate risk to various levels of the organization
• Have experience training and coaching teams to become better security and privacy practitioners
• Like working on an autonomous agile team. At Virtru, you will have ownership of security, but you'll collaborate with everyone to make sure we produce and implement the right solutions
• Ability to resolve conflicts and drive issues to completion
• Work independently with little or no supervision while maintaining a high level of efficiency
• Thinking outside of the box to respectfully challenge your teammates and managers in the pursuit of excellence
• Strong sense of urgency with an action-oriented mindset
• Able to collaborate and adapt to shifting priorities as business needs evolve
• Comfortable with asynchronous communication including slack, email, zoom, etc