Information Security GRC Lead - Policy & Risk Management

NorthMark Compute & Cloud; Dallas (TX); On-site; USD 90,000 - 120,000; Full time

Benefits offered by this job

Lunch stipend

Medical benefits

Dental & Vision

Parental leave

Life insurance

Disability insurance

401(k) match

Flexible benefits

PTO 25 days

Company holidays

Job summary

NorthMark Compute & Cloud is seeking a GRC Analyst to join the Information Security team in Dallas, TX. You will drive security governance, change management, risk assessments, and policy lifecycle, collaborating with Engineering, Product, Legal, and Operations to keep our controls robust and compliant.

You will own the risk register, produce executive‑level summaries, and maintain the policy library aligned to ISO 27001, SOC 2, and NIST CSF. The role offers strong visibility and impact.

Qualifications

• Bachelor degree in IS/CS/Business or equivalent experience.
• 4–8 years in GRC, information security governance, compliance, or risk management.
• Hands‑on experience owning or contributing to security change management, risk assessment, or policy management.
• Working knowledge of ISO 27001, SOC 2, NIST CSF, NIST SP 800‑53, or CIS Controls.
• Experience developing, reviewing, and publishing information security policies, standards, and procedures.
• Familiarity with risk register management: identifying, rating, tracking, and reporting risks.
• Experience with GRC automation platforms such as ServiceNow GRC, Vanta, Drata, Hyperproof, or Archer.
• Proficiency with Jira/Confluence for change tracking, risk registers, and policy workflows.
• Strong written communication translating security requirements to policy language.
• Collaborative across Engineering, Legal, HR, and Operations.
• Certs preferred: CISM, CRISC, CISA, CISSP, ISO 27001 Lead Implementer/Auditor, or CompTIA Security+.

Responsibilities

• Own and operate the security change management review process — triaging change requests and documenting findings and approvals.
• Iterate on change management processes to reduce friction for low‑risk changes while ensuring rigor for high‑risk ones.
• Conduct security reviews for new products, features, third‑party integrations, and vendor onboarding.
• Facilitate threat identification workshops and risk discussions with engineering, product, and operations.
• Maintain the enterprise information security risk register with clear ownership and prioritization.
• Develop risk reporting dashboards and summaries for the CISO and executives.
• Author and manage the information security policy library — aligned to ISO 27001, SOC 2, and NIST CSF.
• Manage the security exception process with the GRC Manager and track expiry/renewal.
• Monitor governance adherence and produce compliance metrics for security leadership.
• Serve as point of contact for cross‑functional forums like CAB and Risk Committee.

Skills

GRC governance

Risk assessment

Policy management

Security frameworks

Policy drafting

Cross-functional collaboration

Jira/Confluence

Education

Bachelor’s degree in Information Systems, CS, or Business Admin

Tools

ServiceNow GRC

Vanta

Drata

Hyperproof

Archer

Jira

Confluence

Job description

NorthMark Compute & Cloud is seeking a GRC Analyst to join the Information Security team in Dallas, TX. You will drive security governance, change management, risk assessments, and policy lifecycle, collaborating with Engineering, Product, Legal, and Operations to keep our controls robust and compliant.

You will own the risk register, produce executive‑level summaries, and maintain the policy library aligned to ISO 27001, SOC 2, and NIST CSF. The role offers strong visibility and impact.