Remote GRC Analyst - SOC 2 & GovRAMP Compliance Lead

InfoTech; Gainesville (FL); Remote; USD 80,000 - 120,000; Full time

Benefits offered by this job

Comprehensive health benefits

Flexible time off

Continuing education and leadership

Inclusive culture

Job summary

Infotech is seeking a GRC Analyst to run the day‑to‑day work of SOC 2 Type II and GovRAMP programs, partnering with engineering, IT, and business teams to collect evidence, document controls, and close gaps. This role is fully remote within the United States, with up to 10% travel during audit periods.

You will own evidence collection, draft policies, manage POA&M, and coordinate cross‑team deliverables to maintain compliance across platforms and customers.

Qualifications

• 5+ years in GRC, security compliance, or IT audit.
• Experience owning at least one SOC 2 Type II or GovRAMP cycle.
• Experience drafting security policies and control narratives.
• Ability to coordinate deliverables across teams without close direction.
• Familiarity with policy as code and AWS Config rules.
• Clear communication with auditors, engineers, and executives.
• Ability to lead investigations and coordinate security incidents.

Responsibilities

• Own SOC 2 Type II evidence collection and readiness for each audit cycle.
• Support GovRAMP assessments (APHS) including POA&M and continuous monitoring.
• Draft and maintain security policies and control narratives aligned with SOC 2/NIST SP 800-53 Rev 5.
• Administer Vanta and automate evidence collection to reduce manual work.
• Perform risk and third‑party assessments; verify AWS controls.
• Coordinate penetration tests and track findings to closure.
• Provide backup coverage for audit and assessment activities.

Skills

GRC experience

SOC 2 Type II

GovRAMP familiarity

Policy as code

Security documentation

Education

CISA / CISSP / CGRC or Security+

Tools

Vanta or similar

Job description

Infotech is seeking a GRC Analyst to run the day‑to‑day work of SOC 2 Type II and GovRAMP programs, partnering with engineering, IT, and business teams to collect evidence, document controls, and close gaps. This role is fully remote within the United States, with up to 10% travel during audit periods.

You will own evidence collection, draft policies, manage POA&M, and coordinate cross‑team deliverables to maintain compliance across platforms and customers.