GRC Analyst

This is a 3 Month Contract to Hire Opportunity.

This position is 100% Remote.

This is an outstanding opportunity for a Sr. GRC Analyst to participate in large global GRC initiatives that literally save lives.

We are a leading global biotech company committed to improving human health through scientific innovation. With a 50+ year legacy of excellence, our publicly traded organization employs over 7,000 global team members, holds 750+ product patents, and generates $6.6 billion in revenue with $153 million in profits. In the past year alone, we launched 6 new products while maintaining our active commitment as a dedicated philanthropic institution.

The GRC Analyst joins the Global Information Security Office to execute international enterprise governance, risk management, and compliance programs. Reporting to the GRC Manager, this role is directly responsible for executing full lifecycle, end-to-end compliance audits and certification programs, conducting third-party vendor risk evaluations, and maintaining global security policies across international enterprise IT and compliance frameworks.

Key Responsibilities

• Full Lifecycle Audits, Certifications & Regulatory Compliance: Performing end-to-end security and compliance audits and maintain adherence to security certifications, from initial audit planning/updating, scoping, evidence collection, interviewing control and process owners and tracking final remediation actions to closure. Audits and Compliance are related to: ISO 27001, NIST, SOC 2 Type II, J-SOX internal controls, and data privacy rules (GDPR, HIPAA, FTC).
• Third-Party Vendor Risk & Framework Governance: Executing end-to-end security evaluations and assessments for third-party vendors and suppliers, issuing risk questionnaires, verifying security controls, and aligning vendor risk with ISO, NIST CSF 2.0, NIST SP 800-53, etc..
• Policy Management & Metrics: Improving and updating global security policies, standards, and procedures while compiling KPIs/KRIs across audit findings and vendor risks for reporting to Executive Management

Requirements

• Must Have: Hands-on experience performing full lifecycle, end-to-end compliance audits and certification management across ISO 27001, SOC 2 Type II, Data Privacy and internal control frameworks (J-SOX).
• Must Have: Experience executing third-party vendor security risk assessments and managing supplier risk workflows in accordance with ISO, NIST, etc.
• Strong working knowledge of core security frameworks and data protection standards (ISO 27001, NIST CSF, GDPR, HIPAA).
• Excellent analytical and communication skills for leading audit interviews, evaluating security controls, standards, procedures and processes, and presenting findings to cross-functional stakeholders and executive management
• Pluses (NOT MANDATORY):
• Experience utilizing enterprise GRC platforms (e.g., BitSight, OneTrust, RSA Archer, Drata) for audit mapping and vendor tracking.
• Professional certifications such as CISSP, CISA, CISM, or ISO 27001 Lead Auditor.
• Exposure to specialized or emerging governance frameworks such as FDA, ISO 13485, ISO 14971, IEC 81001-5-1, 510 (k), PMA s or AI governance frameworks (ISO/IEC 42001, NIST AI RMF) or execution of MDS2 s.
• Experience in International or Global environments

Benefits

Once converted to a FTE permanent employee, company offers a comprehensive benefits package including: 6% matching 401K (immediately vested); 5 Weeks PTO, HMO/PPO Medical, Dental, and Vision coverage for employees; paid company holidays, flexible spending plans/HSA, tuition reimbursement and a casual work environment.