GRC & Security Policy Lead

NMC2; Dallas, Northern (TX, KY); Hybrid; USD 81,000 - 99,000; Full time

Job summary

NorthMark Compute & Cloud (NMC²) is seeking a GRC Analyst to join the Information Security team in Dallas, TX. This role drives governance programs, risk assessments, policy lifecycle, and cross-functional coordination across Engineering, Product, Legal, and Operations.

You will own change management reviews, run risk workshops, maintain the risk register, and develop executive risk reports for the CISO. Strong policy writing and communication skills are essential.

Qualifications

• Bachelor's degree in Information Systems, CS, or related field or equivalent experience.
• 4-8 years in GRC, information security governance, compliance, or risk management.
• Experience owning or contributing to security change management, risk assessment, or policy management.

Responsibilities

• Own and operate the security change management review process and document findings and approvals.
• Iterate on change management processes to reduce friction while preserving rigor for high-risk changes.
• Conduct security reviews for new products, third-party integrations, and vendor onboarding.
• Facilitate threat identification workshops and risk discussions with cross-functional teams.
• Maintain the enterprise information security risk register with clear ownership and prioritization.
• Develop risk reporting dashboards and executive summaries; monitor evolving threats.
• Author and manage the information security policy library aligned to ISO 27001, SOC 2, and NIST CSF.
• Manage security exception process with GRC Manager; track expiry and renewal.
• Monitor governance adherence and produce compliance metrics for leadership.
• Serve as daily point of contact for Engineering, Product, Legal, HR, and Operations.

Skills

GRC

Risk management

Policy management

Change management

Risk assessment

Policy writing

Stakeholder management

Communication

Education

Bachelor's degree

Tools

ServiceNow GRC

Vanta

Drata

Hyperproof

Archer

Jira

Confluence

Job description

NorthMark Compute & Cloud (NMC²) is seeking a GRC Analyst to join the Information Security team in Dallas, TX. This role drives governance programs, risk assessments, policy lifecycle, and cross-functional coordination across Engineering, Product, Legal, and Operations.

You will own change management reviews, run risk workshops, maintain the risk register, and develop executive risk reports for the CISO. Strong policy writing and communication skills are essential.