> Markdown version of [/jobs/ext/4301557-grc-analyst-iii](https://www.wearedevelopers.com/jobs/ext/4301557-grc-analyst-iii). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# GRC Analyst III

- **Company:** Reliance, Inc
- **Location:** Chicago, IL, United States
- **Experience:** Expert
- **Salary:** $120,000.0 - $140,000.0
- **Contract:** Permanent contract
- **Skills:** CompTIA Security+, Cyber Security, Information Systems, Document Management Systems, Issue Tracking Systems, National Institute of Standards and Technology Cybersecurity Framework, CIS Benchmarks
- **Published:** October 11, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=f6af21974f27d008

## About the Role

* Bachelor's degree in Information Systems, Cybersecurity, Risk Management, Business, Audit, or a related field; equivalent work experience may be considered.
 * 7+ years of experience in GRC, information security, IT risk management, compliance, audit, third-party risk, or a related discipline, with demonstrated ownership of complex program or process areas.
 * Experience helping implement, administer, or mature a GRC platform, including control libraries, risk registers, workflows, assessments, issue tracking, exception management, evidence repositories, and reporting dashboards.
 * Strong working knowledge of common security, risk, and compliance frameworks such as NIST CSF, NIST SP 800-53, NIST SP 800-171, CIS Controls, ISO/IEC 27001, SOC 2, CMMC, DFARS, or similar control frameworks.
 * Demonstrated ability to lead risk assessments, document control gaps, evaluate risk, define remediation plans, assign ownership, track due dates, and communicate status to technical and non-technical stakeholders.
 * Experience coordinating internal audits, external audits, customer compliance requests, control testing support, evidence collection, issue remediation, and audit-ready documentation.
 * Experience with policy lifecycle management, standards development, exception management, risk acceptance documentation, and governance reporting preferred.
 * Experience reviewing vendor security artifacts such as SOC reports, questionnaires, certifications, security addenda, and remediation plans preferred.
 * Ability to build structure in an evolving program, create repeatable processes, write clear procedures, define measurable outcomes, and drive accountability across multiple stakeholder groups.
 * Strong analytical, organizational, documentation, and project coordination skills, with the ability to manage competing priorities in an enterprise environment.
 * Strong written, verbal, and presentation communication skills, including the ability to translate technical, regulatory, and audit concepts into practical guidance and executive-ready reporting.
 * Must be self-motivated, detail-oriented, and able to work independently with minimal supervision while partnering effectively with Information Security, IT, Internal Audit, Corporate Risk, Legal, Procurement, and business stakeholders.
 * Professional certification preferred, such as CISA, CRISC, CGRC, CISM, CISSP, Security+, ISO/IEC 27001 Lead Implementer or Lead Auditor, or Cyber AB CMMC Certified Professional.

## Description

GRC Program Buildout & Leadership - Lead the implementation and operational buildout of Reliance's enterprise Governance, Risk & Compliance program.

 * Help define the target-state GRC operating model, including program processes, roles and responsibilities, intake channels, workflows, reporting expectations, and governance routines.
 * Lead configuration, rollout, data quality, and continuous improvement of the GRC platform, including risk registers, control libraries, assessment workflows, issue tracking, exception management, and dashboards.
 * Create practical procedures, templates, standards, and operating documentation that allow the GRC program to scale across business units and control owners.

Risk Management & Control Governance - Establish repeatable processes for identifying, assessing, documenting, and reporting information security and compliance risk.

 * Lead risk assessments with technical, business, and compliance stakeholders; document risks, control gaps, compensating controls, remediation plans, owners, due dates, and residual risk decisions.
 * Develop and maintain risk dashboards, KPIs, KRIs, and leadership reporting that communicate risk posture, remediation progress, exception aging, audit readiness, and control performance.
 * Translate findings from assessments, audits, vulnerability reviews, vendor reviews, and security tools into prioritized risk records and action plans.

Policy, Standards & Exception Management - Lead consistent governance practices for policy lifecycle management and risk-based exceptions.

 * Coordinate policy and standard review cycles, stakeholder feedback, approvals, publication, acknowledgements, and related evidence.
 * Design and operate an exception process covering intake, risk evaluation, documentation, approval routing, renewal cadence, and closure tracking.
 * Partner with control owners to ensure exceptions clearly document business need, risk rationale, compensating controls, expiration dates, and remediation commitments.

Audit, Compliance & Evidence Management - Build and operate audit-defensible processes for internal, external, and regulatory compliance activities.

 * Coordinate evidence requests, control owner responses, issue tracking, remediation updates, and status reporting for internal audits, external audits, customer requests, and compliance assessments.
 * Develop control evidence standards, evidence retention practices, testing support procedures, and quality checks to improve consistency and audit readiness.
 * Support governance activities related to frameworks and obligations such as NIST, CIS Controls, SOC 2, CMMC, DFARS, and other applicable security or compliance requirements.

Third-Party Risk & Cross-Functional Coordination - Lead governance activities that improve visibility into vendor, supplier, and service provider risk.

 * Review vendor security questionnaires, SOC reports, certifications, contract security requirements, and due-diligence artifacts to identify and communicate risk.
 * Partner with Procurement, Legal, Information Security, IT, and business owners to document risk decisions, track remediation, and improve third-party governance processes.
 * Mentor junior team members and help establish consistent expectations for documentation quality, stakeholder follow-up, issue ownership, and executive-ready communication.

Supplemental Duities

 * Pursues training and development opportunities; strives to continuously build knowledge and skills
 * Assist personnel in other IT departments to resolve technical and/or application issues
 * Participates and assists with internal and external audits
 * Other duties as requested