Policy Analyst

Insight Global; United States; On-site; USD 90,000 - 120,000; Full time

Job summary

Insight Global is seeking a Policy Analyst skilled in security governance, risk, and compliance to help develop, maintain, and enhance enterprise security policies and standards. The role emphasizes policy creation, control mapping to NIST 800-53 and ISO 27001, and collaboration with cross-functional stakeholders to strengthen security posture.

The candidate will translate regulatory requirements into actionable documentation, perform gap analyses, and support audits and evidence collection,

Qualifications

• 3+ years of hands-on experience with NIST 800-53 controls.
• Experience writing, reviewing, and maintaining security policies, standards, and procedures.
• Strong knowledge of ISO 27001 and ISMS.
• Experience supporting governance, risk, and compliance initiatives.
• Ability to translate regulatory requirements into business-friendly documentation.
• Experience performing control mapping, gap assessments, and policy alignment.
• Excellent written communication and documentation skills.

Responsibilities

• Develop, update, and maintain enterprise security policies, standards, and procedures.
• Map organizational controls to NIST 800-53 and ISO 27001 requirements.
• Conduct gap analyses and recommend policy improvements.
• Partner with security, compliance, legal, audit, and business stakeholders to ensure policy alignment.
• Support compliance assessments, audits, and evidence collection activities.
• Maintain documentation related to security governance and control frameworks.
• Assist with continuous improvement of security and compliance programs.

Skills

NIST 800-53

Policy writing

ISO 27001

GRC

Policy mapping

Stakeholder collaboration

Tools

GRC platforms

Job description

Duration: Contract through January 31, 2027 - extensions highly likely

Position Summary

We are seeking a Policy Analyst with deep expertise in security governance, risk, and compliance to support the development, maintenance, and enhancement of enterprise security policies and standards. This role will focus heavily on policy creation and control mapping aligned with NIST 800-53 and ISO 27001 frameworks. The ideal candidate has experience translating security controls into actionable policies, standards, and procedures while partnering with cross-functional stakeholders to maintain compliance and strengthen the organization's security posture.

Required Qualifications

• 3+ years of hands-on experience working with NIST 800-53 security controls.
• Experience writing, reviewing, and maintaining security policies, standards, and procedures.
• Strong knowledge of ISO 27001 and Information Security Management Systems (ISMS).
• Experience supporting governance, risk, and compliance (GRC) initiatives.
• Ability to interpret regulatory and security framework requirements and translate them into business-friendly documentation.
• Experience performing control mapping, gap assessments, and policy alignment activities.
• Strong written communication and documentation skills.

Preferred Qualifications

• Experience with FedRAMP, FISMA, RMF, SSPs, ATOs, or POA&Ms.
• Background in cloud security, SaaS environments, or enterprise technology organizations.
• Experience using GRC platforms or compliance management tools.
• Certifications such as:
• CGRC (formerly CAP)
• CISSP
• CISA
• CRISC

Key Responsibilities

• Develop, update, and maintain enterprise security policies, standards, and procedures.
• Map organizational controls to NIST 800-53 and ISO 27001 requirements.
• Conduct gap analyses and recommend policy improvements.
• Partner with security, compliance, legal, audit, and business stakeholders to ensure policy alignment.
• Support compliance assessments, audits, and evidence collection activities.
• Maintain documentation related to security governance and control frameworks.
• Assist with continuous improvement of security and compliance programs.