> Markdown version of [/jobs/ext/2695109-grc-analyst](https://www.wearedevelopers.com/jobs/ext/2695109-grc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # GRC Analyst - **Company:** Beacon Hill Staffing Group, LLC - **Location:** Houston, TX, United States - **Experience:** Experienced - **Contract:** Temporary contract - **Skills:** Cyber Security, Executive Information Systems, Supervisory Control and Data Acquisition (SCADA), Identity and Access Management, Information Technology Audit, Software Vulnerability Management, IT General Controls (ITGC), Process Control Systems, RSA Archer Platform, Operational Systems, CIS Benchmarks, Servicenow - **Published:** September 3, 2026 - **Apply:** https://jobs.mitalent.org/job-seeker/job-details/JobCode/405770312 ## About the Role 27001, SOC 2, and CIS Controls.\n * Maintain risk registers, compliance calendars, control inventories, and audit repositories.\n * Prepare compliance reports, dashboards, scorecards, and presentations for leadership.\n * Monitor remediation efforts and work with control owners to ensure timely issue resolution.\n * Support continuous improvement initiatives across the information security governance program.\n * Stay informed on cybersecurity regulations, compliance trends, and industry best practices.\nRequired Qualifications\n\n * 3+ years of experience in Governance, Risk & Compliance (GRC), cybersecurity compliance, IT audit, information security, or related disciplines.\n * Strong knowledge of:\n\n * NIST Cybersecurity Framework (CSF)\n * NIST 800-53\n * NIST 800-171\n * ISO 27001\n * SOC 2\n * CIS Controls\n\n * Experience supporting audits, evidence collection, control testing, remediation tracking, and compliance reporting.\n * Ability to develop and maintain security policies, standards, procedures, and control documentation.\n * Experience conducting risk assessments, gap assessments, and control reviews.\n * Familiarity with third-party and vendor risk management processes.\n * Strong documentation and communication skills with the ability to translate technical concepts into business-friendly language.\n * Experience working with cross-functional teams across technology and business organizations.\n * Knowledge of enterprise security controls including identity and access management, vulnerability management, incident response, and change management.\n * Strong organizational skills and ability to manage multiple initiatives simultaneously.\nPreferred Qualifications\n\n * Experience within energy, utilities, renewable energy, power generation, critical infrastructure, or industrial environments.\n * Knowledge of NERC CIP, FERC, or similar industry regulations.\n * Exposure to OT/SCADA environments, substations, generation assets, EMS, DERMS, or industrial control systems.\n * Certifications such as:\n\n * CISA\n * CISSP\n * CISM\n * CRISC\n * Security+\n * ISO 27001 Lead Auditor/Implementer\n\n * Experience with GRC platforms such as:\n\n * ServiceNow GRC\n * Archer\n * OneTrust\n * AuditBoard\n * LogicGate\n * Drata\n * Vanta\n\n * Experience supporting SOC 2, ISO 27001, SOX ITGC, PCI, or customer security reviews.\n * Experience creating executive dashboards, compliance scorecards, risk registers, and audit reporting.\nWhy Join?\n\n * Opportunity to help build and define a new GRC function.\n * High visibility within a growing Information Security organization.\n * Exposure to both traditional enterprise IT and operational technology environments.\n * Opportunity to contribute to the modernization of cybersecurity, risk, and compliance practices within a critical infrastructure environment.\n * Strong potential for long-term conversion ## Description Beacon Hill was founded to set a new standard in search, career placement and flexible staffing. \n\nGovernance, Risk & Compliance (GRC) Specialist\n\nLocation: Houston, TX (Hybrid: 3 days onsite, 2 remote) OR Chicago, IL (Remote)\n Duration: 6-Month Contract (Strong Extension/Conversion Potential)\n Start Date: Approximately 3 Weeks from Offer\n\nOverview\n\nWe are seeking a Governance, Risk & Compliance (GRC) Specialist to join a growing Information Security team supporting a large-scale critical infrastructure environment. This individual will play a key role in strengthening governance, risk management, compliance, and cybersecurity processes across corporate IT, cloud platforms, and operational technology (OT) environments.\n\nThis is a unique opportunity to help build and mature a cybersecurity governance program from the ground up while partnering closely with security, engineering, infrastructure, legal, procurement, and business stakeholders.\n\nKey Responsibilities\n\n * Support and maintain the organization's governance, risk, and compliance program across IT, cloud, and OT environments.\n * Develop, review, and maintain security policies, standards, procedures, and control documentation.\n * Coordinate audit evidence collection for internal audits, external audits, compliance reviews, and customer assessments.\n * Track audit findings, remediation plans, control deficiencies, policy exceptions, and risk acceptance activities.\n * Perform control testing and compliance validation to ensure security controls are operating effectively.\n * Assist with risk assessments, gap assessments, compliance readiness activities, and control maturity reviews.\n * Support vendor and third-party risk management activities, including security questionnaires and risk reviews.\n * Collaborate with IT, Security Operations, Infrastructure, Engineering, Legal, Procurement, Compliance, and Operations teams.\n * Map security controls to frameworks including NIST, ISO ## Related Videos - [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) - [A practical guide to writing secure Dockerfiles](https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Applying Agile Principles to Incident Management ](https://www.wearedevelopers.com/videos/101-applying-agile-principles-to-incident-management) - [Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?](https://www.wearedevelopers.com/videos/100248-reporting-active-exploits-in-24-hours-are-you-ready-for-the-cra) - [OPA for the cloud natives](https://www.wearedevelopers.com/videos/713-opa-for-the-cloud-natives) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Best Companies to work for in London: Top 25 Companies in 2023](https://www.wearedevelopers.com/magazine/187-best-companies-to-work-for-in-london-top-25-companies-in-2023) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)