GRC Security Analyst

Planet Group; Boston (MA); Hybrid; USD 69,000 - 83,000; Full time

Job summary

Planet Group, partnering with a Boston based company, seeks a Governance and Risk Compliance Specialist (GRC) in Boston, MA or New York City. The role focuses on information security governance, risk, and compliance, including policy development, audit support, and vulnerability tracking.

The position offers hybrid work with two days onsite per week in Boston or NYC, contract-to-hire employment, and a pay rate of $50-$60 per hour.

Qualifications

• Experience in information security, governance, risk, and compliance.
• Experience developing security policies and compliance documentation.
• Background supporting security audits and evidence collection.
• Understanding of application access governance, user access reviews, and access documentation.
• Experience reviewing security reports, tracking vulnerabilities, and coordinating remediation activities.
• Strong analytical and reporting skills.
• Excellent written and verbal communication skills.
• Strong organizational skills with attention to detail.
• Proactive problem-solving and process improvement.
• Ability to collaborate across Security, Engineering, Infrastructure, and IT teams.

Responsibilities

• Develop and maintain information security policies, procedures, and supporting documentation aligned with frameworks and business requirements.
• Coordinate audit requests, gather evidence, and work with internal teams to respond to external auditors.
• Support data protection, privacy, and information security compliance initiatives.
• Conduct periodic application access reviews and maintain access records.
• Assist with documentation and provisioning for new applications and users.
• Review vulnerability scan results and organize findings by severity and affected asset.
• Coordinate with application owners and Infrastructure to track remediation progress and escalate as needed.
• Consolidate security metrics from multiple sources into clear management reports.
• Identify and communicate security and risk trends, remediation priorities, and open items.
• Support security awareness training and reporting of completion and activity.

Skills

Info security

Policy development

Audit support

Access reviews

Vulnerability tracking

Reporting skills

Communication skills

Organizational skills

Problem solving

Cross-functional collaboration

Tools

Qualys

KnowBe4

CrowdStrike

Microsoft Intune

Jamf

Clarity Security

Job description

Title: Governance and Risk Compliance Specialist (GRC)

Location: Boston, MA or New York City

Schedule: Hybrid; two days onsite per week

Employment Type: contract-to-hire

Rate: $50-$60/hour

The Planet Group has partnered with a Boston based company to locate a GRC Security Analyst to support information security governance, risk, and compliance activities. This role combines policy development, audit support, application access reviews, vulnerability tracking, and security reporting.

The role can also be based in New York but does still require two days a week onsite in Manhattan.

The successful candidate will work with Security, Cybersecurity Engineering, Infrastructure, and application owners to keep documentation current, track security issues, and turn information from multiple sources into clear reporting for management.

Responsibilities

• Develop and maintain information security policies, procedures, and supporting documentation aligned with established frameworks and business requirements.
• Coordinate audit requests, gather evidence, and work with internal teams to provide accurate, timely responses to external auditors.
• Support data protection, privacy, and information security compliance initiatives.
• Conduct periodic application access reviews, validate user permissions, and maintain access records.
• Assist with documentation and provisioning processes for new applications and users.
• Review vulnerability scan results and organize findings by severity, affected device, and application.
• Coordinate with application owners and Infrastructure teams to track remediation progress, follow up on outstanding findings, and elevate concerns.
• Consolidate security metrics from multiple sources into clear management reports and executive summaries.
• Identify and communicate security and risk trends, remediation priorities, and outstanding issues.
• Support security awareness training and maintain completion and activity reporting.
• Participate in security and management meetings, providing updates on progress, risks, and open items.
• Help improve security processes, documentation, and reporting across IT teams.

Required Skills and Experience:

• Experience in information security, governance, risk, and compliance, or a related cybersecurity function.
• Experience developing and maintaining security policies, procedures, and compliance documentation.
• Background supporting security audits, including evidence collection and coordination of audit requests.
• Understanding of application access governance, user access reviews, and access documentation.
• Experience reviewing security reports, tracking vulnerabilities, and coordinating remediation activities.
• Strong analytical skills and the ability to turn data from multiple sources into clear, actionable reporting.
• Strong written and verbal communication skills, including the ability to explain security findings to technical teams, business stakeholders, and management.
• Excellent organizational skills, attention to detail, and the ability to manage competing priorities.
• A proactive approach to problem-solving, stakeholder follow-up, and process improvement.
• Ability to collaborate across Security, Engineering, Infrastructure, and other IT teams.
• Must be located in the Boston or New York City area and available to work onsite two days per week.

Preferred Skills/Experience:

• Familiarity with security frameworks and standards such as NIST, ISO 27001, and Cyber Essentials.
• Experience with Qualys for vulnerability management and remediation tracking.
• Familiarity with KnowBe4 or similar security awareness training platforms.
• Exposure to CrowdStrike, Bitdefender, Microsoft Intune, or Jamf.
• Experience with Clarity Security or similar identity and access governance platforms.
• Knowledge of data protection, privacy, and information security risk management practices.
• Experience preparing executive-level security metrics, dashboards, and compliance reports

#LI-SC1 #TECH #HYBRID