Senior / Principal GRC Analyst

Job Details: Job Description: Role Summary The Senior / Principal GRC Analyst is a senior individual contributor responsible for architecting, leading, and scaling enterprise governance, risk, and compliance programs across highly regulated, technology‑driven environments. This role owns implementation and continuous improvement of ISO/IEC 27001, ISO/IEC 42001 (AI Management Systems), GDPR, CCPA/CPRA, and CMMC, and acts as a trusted advisor to security leadership, engineering, legal, and executive stakeholders. This role requires strong hands‑on cybersecurity knowledge, deep regulatory expertise, and the ability to translate technical security architectures into audit‑ready, business‑aligned compliance outcomes. Core Responsibilities (All Environments) Define and maintain a risk‑based GRC architecture aligned to ISO, NIST, privacy, and regulatory requirements. Lead end‑to‑end implementations of:ISO/IEC 27001 (ISMS ownership, risk methodology, SoA, internal audits) ISO/IEC 42001 (AI governance, AI risk and control design) GDPR and CCPA/CPRA privacy programs CMMC / NIST SP 800‑171 Translate security architectures and technical controls into compliant policies, standards, and evidence. Lead enterprise, third‑party, cloud, and AI‑specific risk assessments. Serve as primary interface for auditors, assessors, regulators, customers, and partners. Drive efficiency using GRC platforms, security telemetry, and AI‑assisted compliance tooling. Mentor junior GRC professionals and influence cross‑functional teams without direct authority. Technical Cybersecurity Skills & Expectations Security Architecture & Controls Strong understanding of defense‑in‑depth architectures, including:Network segmentation, firewalls, IDS/IPS Endpoint Detection & Response (EDR/XDR) Identity and Access Management (IAM), SSO, MFA, RBAC Ability to assess and validate technical control effectiveness, not just paper compliance. Cloud & SaaS Security Hands‑on familiarity with cloud security models (AWS, Azure, GCP concepts):Shared responsibility Logging and monitoring Encryption at rest and in transit Secure CI/CD and infrastructure‑as‑code risks Ability to map cloud security controls to ISO 27001, NIST, and CMMC requirements. Data Protection & Privacy Engineering Understanding of:Data classification and labeling DLP, encryption, key management Data residency and cross‑border data transfer controls Ability to work with engineering teams on privacy‑by‑design implementations. Vulnerability & Risk Management Familiarity with:Vulnerability management lifecycle Secure configuration baselines Risk acceptance, compensating controls, and technical debt Ability to assess real‑world risk rather than checklist compliance. Incident Response & Monitoring Knowledge of incident response processes, including:Detection, containment, and post‑incident reviews Regulatory and contractual notification requirements Ability to validate IR plans against ISO and regulatory expectations.