Remote Lead InfoSec & GRC — Audits & Compliance

Great Gray Group.; Rhode Island; Remote; USD 120,000 - 160,000; Full time

Benefits offered by this job

Group medical insurance

Dental insurance

Vision insurance

Employer-paid life insurance

Disability insurance

401(k) plan

Job summary

Great Gray Group is seeking a Lead Information Security Analyst to lead IT governance, risk assessment, and security compliance across SOC 2 and the NIST CSF. This remote role supports enterprise risk management and develops ISMS policies and practices for the organization.

The position requires collaboration across teams to maintain security controls, documentation, and audit readiness, while mentoring junior staff in GRC functions.

Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, IT or related field.
• 5–10+ years audit, compliance or technical experience.
• Strong knowledge of IT security controls and audit best practices.
• Excellent written and verbal communication with leadership.

Responsibilities

• Lead and manage GRC functions including monitoring, audits, and risk assessment.
• Ensure compliance with SOC 2, NIST, and other standards.
• Prepare for and manage audits, assessments, and regulatory reviews.
• Maintain security documentation and audit trails.
• Develop and enforce information security policies and procedures.
• Vendor risk assessments, onboarding, and reviews.
• Mentor Information Security Analysts in GRC functions.
• Conduct vulnerability assessments and penetration testing.
• Participate in incident response and post-incident analysis.

Skills

GRC leadership

SOC 2

NIST CSF

Policy development

Audit management

Vendor risk

Incident response

Effective communication

Education

Bachelor’s degree in Computer Science, Cybersecurity, IT or related field

Tools

GRC software

Vulnerability scanners

Job description

Great Gray Group is seeking a Lead Information Security Analyst to lead IT governance, risk assessment, and security compliance across SOC 2 and the NIST CSF. This remote role supports enterprise risk management and develops ISMS policies and practices for the organization.

The position requires collaboration across teams to maintain security controls, documentation, and audit readiness, while mentoring junior staff in GRC functions.