Remote GRC Analyst: SOC 2, GovRAMP & Policy

Infotech; Lorida (FL); Remote; USD 90,000 - 130,000; Full time

Benefits offered by this job

Flexible work-life support

Job summary

Infotech is seeking a GRC Analyst to run the day-to-day of our SOC 2 Type II and GovRAMP programs, partnering with engineering, IT, and business teams to collect evidence, document controls, and close gaps. If you’re driving on a highway in North America, there’s a good chance Infotech software helped build it.

88% of state transportation agencies use Infotech-developed software to manage road construction.

Qualifications

• 5+ years of experience in GRC, security compliance, or IT audit.
• Experience writing security policies and control documentation.
• Familiarity with policy as code, such as Open Policy Agent or AWS Config rules.
• Experience supporting GovRAMP, StateRAMP, or FedRAMP programs, including POA&M management or continuous monitoring.
• Good understanding of cloud security policies.
• Experience with government or other contract-driven customers.
• Administration of Vanta, Drata, or a similar compliance platform.
• Ability to read AWS configuration evidence and know what good looks like.
• Experience automating compliance work with scripts or APIs.

Responsibilities

• Run day-to-day work of SOC 2 Type II and GovRAMP programs and collaborate with engineering, IT, and business teams to collect evidence, document controls, and close gaps.
• Own SOC 2 Type II evidence collection and readiness for each audit cycle, from requests to auditor delivery.
• Support GovRAMP assessments for APHS, including evidence packages and continuous monitoring deliverables.
• Draft and maintain security policies and control narratives aligned with SOC 2 and NIST SP 800-53 Rev 5.
• Administer Vanta and automate evidence collection to reduce manual work for engineering teams.
• Perform risk and third-party assessments, and verify AWS controls are documented.
• Coordinate penetration tests, track findings to closure, and manage customer security questionnaires.
• Assign and track compliance tasks with control owners across teams.

Skills

GRC

Security compliance

IT audit

Policy as code

GovRAMP/StateRAMP/FedRAMP

Cloud security policies

Government contracts

Vanta/Drata administration

AWS configuration evidence

Automation via scripts/APIs

Tools

Vanta

Drata

AWS Config rules

Job description

Infotech is seeking a GRC Analyst to run the day-to-day of our SOC 2 Type II and GovRAMP programs, partnering with engineering, IT, and business teams to collect evidence, document controls, and close gaps. If you’re driving on a highway in North America, there’s a good chance Infotech software helped build it.

88% of state transportation agencies use Infotech-developed software to manage road construction.