Remote GRC Analyst: Build Audit-Ready Security & Compliance

MerciIT; Atlanta (GA); On-site; USD 90,000 - 120,000; Full time

Job summary

Merci Technologies is seeking a GRC Analyst to support governance, risk, and compliance for an enterprise client. The role sits at the intersection of security, audit, and business operations, translating complex regulatory requirements into practical controls that teams can implement and sustain.

The position is fully remote and open to Contract or Full‑Time candidates, with responsibilities spanning control assessments, audit planning, policy maintenance, vendor risk, and risk reporting to

Qualifications

• Experience in governance, risk and compliance programs.
• Ability to translate regulatory requirements into actionable controls.
• Strong documentation, organization, and stakeholder communication skills.

Responsibilities

• Conduct control assessments against frameworks (NIST CSF, NIST 800-53, ISO 27001, SOC 2, CMMC).
• Plan and support internal and third‑party audits with scoping and evidence collection.
• Track findings to remediation and closure; escalate risks where needed.
• Develop and maintain security policies, standards, and procedures.
• Perform vendor and third‑party risk assessments and document risk decisions.
• Maintain the risk register and report risk posture to leadership.
• Support regulatory, customer, and compliance reporting requests.
• Operationalize new framework or regulatory requirements as they emerge.

Skills

Governance

Risk Management

Compliance

Audit

Documentation

Tools

Archer

ServiceNow GRC

OneTrust

Job description

Merci Technologies is seeking a GRC Analyst to support governance, risk, and compliance for an enterprise client. The role sits at the intersection of security, audit, and business operations, translating complex regulatory requirements into practical controls that teams can implement and sustain.

The position is fully remote and open to Contract or Full‑Time candidates, with responsibilities spanning control assessments, audit planning, policy maintenance, vendor risk, and risk reporting to