GRC Analyst

Infotech; Gainesville (FL); Remote; USD 85,000 - 110,000; Full time

Benefits offered by this job

Health benefits

Flexible time off

Continuing education programs

Inclusive culture

Job summary

Infotech is seeking a GRC Analyst to run day-to-day SOC 2 Type II and GovRAMP activities, coordinating across engineering, IT, and business teams to collect evidence, document controls, and close gaps.

You will own evidence collection, support GovRAMP assessments, draft security policies, and administer compliance tooling to streamline audits while communicating clearly with auditors and executives.

Qualifications

• 5+ years of experience in GRC, security compliance, or IT audit.
• Ownership of at least one full SOC 2 Type II audit cycle or GovRAMP assessment.
• Experience writing security policies and control documentation.
• Coordinate deliverables across several teams with minimal direction.
• Familiarity with policy as code and related tooling.
• Clear communication with auditors, engineers, and executives.
• Ability to lead, investigate, and coordinate security incidents.
• Experience with GovRAMP/StateRAMP/FedRAMP programs (nice to have).

Responsibilities

• Own SOC 2 Type II evidence collection and readiness for each audit cycle.
• Support GovRAMP assessments including POA&M and continuous monitoring.
• Draft and maintain security policies and control narratives aligned with SOC 2 and NIST SP 800-53 Rev 5.
• Administer Vanta/Drata and automate evidence collection to reduce manual work.
• Perform risk and third-party assessments; verify AWS technical controls.
• Coordinate penetration tests and track findings to closure.
• Provide backup coverage for audit and assessment activity.

Skills

GRC experience

Security compliance

IT audit

Policy coordination

Open Policy Agent

Education

CISA

CISSP

CISM

CGRC

Tools

Vanta

Drata

AWS Config rules

Job description

Position Title: GRC Analyst

Job Category: Career Opportunities

Requisition Number: GRCAN001608

Full-Time

Gainesville, FL 32608, USA

Description

Infotech® is seeking a GRC Analyst to run the day-to-day work of our SOC 2 Type II and GovRAMP programs, partnering with engineering, IT, and business teams to collect evidence, document controls, and close gaps.

Who we are

If you’re driving on a highway in North America, there’s a good chance Infotech software helped build it. In the U.S., 88% of state transportation agencies use Infotech-developed software to manage road construction. From digital bidding to secure document signing, from cost estimation to inspection, we build tools that streamline infrastructure project delivery and ensure transparency, quality, and compliance.

We’re proud to be a Certified™ Great Place to Work®, with a people-first culture, outstanding employee retention, and flexible work-life support. Headquartered in Gainesville, Florida, Infotech is a pioneer in civil construction software and a vibrant community of technologists, collaborators, and problem solvers.

What you’ll do

State DOTs, local agencies, and contractors rely on Infotech software to deliver public infrastructure. Our Security & Compliance (GRC) team, part of Platform Engineering, keeps that trust measurable by maintaining SOC 2 Type II and GovRAMP programs across our products, including AASHTOWare Project Hosting Services (APHS). As the GRC Analyst, you run the day-to-day work of those programs and work with engineering, IT, and business teams to collect evidence, document controls, and close gaps. You will:

• Own SOC 2 Type II evidence collection and readiness each audit cycle, from the request list through auditor delivery.
• Support GovRAMP assessments for APHS, including evidence packages, the POA&M, and continuous monitoring deliverables.
• Draft and maintain security policies and control narratives aligned with SOC 2 and NIST SP 800-53 Rev 5.
• Administer Vanta and automate evidence collection to reduce manual work for engineering teams.
• Perform risk and third-party assessments, and verify that technical controls in AWS operate as documented.
• Coordinate penetration tests, track findings to closure, and own the customer security questionnaire process.
• Provide backup coverage for audit and assessment activity as directed.

This role has no direct reports. You will assign and follow up on compliance tasks with control owners in other teams.

QUALIFICATIONS

You must have

• 5+ years of experience in GRC, security compliance, or IT audit.
• Ownership of at least one full SOC 2 Type II audit cycle or GovRAMP assessment, from readiness through remediation.
• Experience writing security policies and control documentation.
• The ability to coordinate deliverables across several teams and keep work moving without close direction.
• Familiarity with policy as code, such as defining and testing controls with Open Policy Agent, AWS Config rules, or infrastructure-as-code policy checks.
• Clear communication with auditors, engineers, and executives.
• The ability to lead, investigate, and coordinate security incidents.

We’d like you to have

• Experience supporting GovRAMP, StateRAMP, or FedRAMP programs, including POA&M management or continuous monitoring.
• A good understanding of cloud security policies.
• A certification such as CGRC, CISA, CISSP, CISM, or Security+.
• Experience with government or other contract-driven customers.

Technical skills we’d like you to have

• Administration of Vanta, Drata, or a similar compliance platform.
• The ability to read AWS configuration evidence and know what good looks like.
• Experience automating compliance work with scripts or APIs.

Where you’ll work

Construct your future with us while working fully remote within the US.

Our commitment to you as an Infotecher

• Comprehensive health benefits and inclusive wellness support
• Flexible time off and paid holidays
• Continuing education and leadership development programs
• An inclusive culture built on empathy, connection, and trust

Read more about our people-first initiatives on our website.

Other requirements

This position requires up to 10% travel. Occasional after-hours work is expected during audit and assessment periods.

Additional Information

This position will remain posted until October 30th at 4pm ET. This role is not sponsorship eligible.

A resume is required. Cover letter is recommended.

In compliance with pay and benefits transparency requirements, please visit the Total Rewards page on our website.

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities

This employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights notice from the Department of Labor.

Equal employment opportunity, including veterans and individuals with disabilities.