> Markdown version of [/jobs/ext/1154616-senior-grc-analyst](https://www.wearedevelopers.com/jobs/ext/1154616-senior-grc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior GRC Analyst - **Company:** MORGAN & MORGAN, P.A. - **Location:** Orlando, FL, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Cyber Security, Information Technology Audit, Phishing, Data Processing, Information Technology - **Published:** July 2, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=006136832e72bf2e ## About the Role * 4-6+ years in GRC, IT audit, compliance, or information security * Deep hands-on experience in a GRC platform; Vanta strongly preferred * Strong working knowledge of ISO 27001, NIST CSF, and CIS v8.1; you've mapped controls across multiple frameworks at the same time * ISC2 CC/CCSP or ISACA CRISC/CISA required, or other ISC2 or ISACA related certifications (CISSP, CISM) * Direct experience leading external audits or client security due diligence as primary point of contact, including findings negotiation * You've designed a security awareness program * Comfortable operating independently * Bachelor's degree in Information Security, Risk Management, Computer Science, or related field; equivalent experience considered ## Description This is not a maintenance role. You're joining at the ground floor of a GRC program that needs to be built from a standing start - TPRM methodology, policy lifecycle, risk register calibration, awareness program design. You'll own workstreams end-to-end, not coordinate them. You report directly to the Director of Business Continuity, who owns the GRC function and sets program direction. If you want to inherit a mature program and tune it, this isn't for you. If you want to build one - with real ownership, real scope, and a clear path to being the person who shapes how risk is managed across a national law firm - read on. What You'll Own Third-Party Risk Management * Build and own the end-to-end TPRM process: risk tiering, assessment criteria, and escalation thresholds - from scratch * Lead risk assessments for the firm's highest-exposure vendor relationships: case management, e-discovery, payment processing, and others * Bring risk acceptance and remediation recommendations to the Director; own the analysis behind the decision Policy Lifecycle * Run the full policy lifecycle: drafting, review cadence, approval workflows, and firm-wide attestation tracking * Write policy content directly - you're not inheriting a library, you're building it, translating framework requirements into language that works for a law firm * Identify and close policy gaps against ISO 27001, NIST CSF, and CIS v8.1 before they become audit findings Risk Management * Own the enterprise risk register: methodology, scoring calibration, and quarterly review cadence * Lead control testing and gap assessment in Vanta; design remediation plans * Spot emerging risk trends and bring recommendations Security Awareness * Assist with the design of the security awareness program strategy: content calendar, phishing simulation progression, targeted training for high-risk roles, and Program Champions * Analyze effectiveness data and adjust the program based on results, not just completion rates Audit & Compliance Readiness * Serve as a point of contact for cyber insurance audits, major client security due diligence, and regulatory inquiries * Own the audit calendar and evidence readiness posture - you're not responding to requests as they land, you're ahead of them Reporting & Program Visibility * Build and maintain the GRC reporting suite for CIO-level consumption: risk posture snapshots, control testing results, TPRM exposure summaries * Identify maturity gaps against framework requirements and bring prioritized roadmap recommendations to the Director Cross-Program Coordination * Interface with the BC/DR and Crisis Management program on control alignment, vendor dependencies surfaced in BIAs, and recovery capability assumptions * Coordinate with the Privacy function (in build) on data inventory, state privacy law obligations (FL, CA, NY, and others), and third-party data handling risks * Once the GRC Analyst is hired, serve as a working mentor without formal management authority ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Implementing continuous delivery in a data processing pipeline](https://www.wearedevelopers.com/videos/73-implementing-continuous-delivery-in-a-data-processing-pipeline) - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?](https://www.wearedevelopers.com/videos/100248-reporting-active-exploits-in-24-hours-are-you-ready-for-the-cra) - [Forecasting Cyber Attacks with Glassdoor Reviews - Lianne Potter](https://www.wearedevelopers.com/videos/2143-forecasting-cyber-attacks-with-glassdoor-reviews-lianne-potter) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [What’s the Difference between a Junior, Mid, and Senior Developer?](https://www.wearedevelopers.com/magazine/238-what-s-the-difference-between-a-junior-mid-and-senior-developer) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Data Analyst Salary in Switzerland](https://www.wearedevelopers.com/magazine/276-data-analyst-salary-in-switzerland)