GRC Analyst

Infotech; Florida; Remote; USD 90,000 - 130,000; Full time

Benefits offered by this job

Flexible time off and paid holidays

Job summary

Infotech is seeking a GRC Analyst to run the day-to-day work of SOC 2 Type II and GovRAMP programs, partnering with engineering, IT, and business teams to collect evidence, document controls, and close gaps. The role supports GovRAMP assessments and continuous monitoring across APHS and related products.

As part of the Security & Compliance (GRC) team, you will administer Vanta/Drata, draft security policies, and coordinate audits, with up to 10% travel and remote work within the US.

Qualifications

• 5+ years in GRC, security compliance, or IT audit.
• Experience writing security policies and control documentation.
• Familiarity with policy as code and AWS Config rules.
• Experience supporting GovRAMP/StateRAMP/FedRAMP programs and continuous monitoring.
• Administration of Vanta, Drata, or similar platforms.
• Ability to read AWS configuration evidence and identify good/bad configurations.

Responsibilities

• Run day-to-day work of SOC 2 Type II and GovRAMP programs.
• Collaborate with engineering, IT, and business teams to collect evidence and document controls.
• Close gaps and prepare evidence packages for audits.
• Coordinate penetration tests and track findings to closure.
• Manage POA&Ms and continuous monitoring deliverables.
• Assign and follow up on tasks with control owners across teams.

Skills

GRC experience

Security policies

Policy as code

GovRAMP/StateRAMP/FedRAMP

Vanta/Drata administration

AWS config/automation

Tools

Vanta

Drata

Open Policy Agent

Job description

Infotech® is seeking a GRC Analyst to run the day-to-day work of our SOC 2 Type II and GovRAMP programs, partnering with engineering, IT, and business teams to collect evidence, document controls, and close gaps. If you’re driving on a highway in North America, there’s a good chance Infotech software helped build it. 88% of state transportation agencies use Infotech-developed software to manage road construction. From digital bidding to secure document signing, from cost estimation to inspection, we build tools that streamline infrastructure project delivery and ensure transparency, quality, and compliance.

We’re proud to be a Certified™ Great Place to Work ® , with a people-first culture, outstanding employee retention, and flexible work-life support. Headquartered in Gainesville, Florida, Infotech is a pioneer in civil construction software and a vibrant community of technologists, collaborators, and problem solvers.

State DOTs, local agencies, and contractors rely on Infotech software to deliver public infrastructure. Our Security & Compliance (GRC) team, part of Platform Engineering, keeps that trust measurable by maintaining SOC 2 Type II and GovRAMP programs across our products, including AASHTOWare Project Hosting Services (APHS). As the GRC Analyst, you run the day-to-day work of those programs and work with engineering, IT, and business teams to collect evidence, document controls, and close gaps. Own SOC 2 Type II evidence collection and readiness each audit cycle, from the request list through auditor delivery.

Support GovRAMP assessments for APHS, including evidence packages, the POA&M, and continuous monitoring deliverables.

Draft and maintain security policies and control narratives aligned with SOC 2 and NIST SP 800-53 Rev 5.

Administer Vanta and automate evidence collection to reduce manual work for engineering teams.

Perform risk and third-party assessments, and verify that technical controls in AWS operate as documented.

Coordinate penetration tests, track findings to closure, and own the customer security questionnaire process.

You will assign and follow up on compliance tasks with control owners in other teams.

• 5+ years of experience in GRC, security compliance, or IT audit.
• ~ Experience writing security policies and control documentation.
• ~ Familiarity with policy as code, such as defining and testing controls with Open Policy Agent, AWS Config rules, or infrastructure-as-code policy checks.
• ~ Experience supporting GovRAMP, StateRAMP, or FedRAMP programs, including POA&M management or continuous monitoring.
• A good understanding of cloud security policies.
• Experience with government or other contract-driven customers.
• Administration of Vanta, Drata, or a similar compliance platform.
• The ability to read AWS configuration evidence and know what good looks like.
• Experience automating compliance work with scripts or APIs.

Construct your future with us while working fully remote within the US.

• Flexible time off and paid holidays

Read more about our people-first initiatives on our website.

This position requires up to 10% travel. Occasional after-hours work is expected during audit and assessment periods.

In compliance with pay and benefits transparency requirements, please visit the Total Rewards page on our website.