Security GRC Analyst: SOC 2, NIST CSF & AI Governance

Momentum; Dallas (TX); Hybrid; USD 110,000 - 160,000; Full time

Benefits offered by this job

Healthcare benefits

401(k) with employer match

Disability insurance

Paid time off

Parental leave

Paid holidays

Job summary

Momentum is seeking a Security GRC & Risk Analyst to own governance, risk, and compliance across a holding company and portfolio of businesses. You will lead SOC 2 Type II evidence collection, NIST CSF remediation, policy library management, and vendor risk programs from our Dallas office.

Collaborate with the Cybersecurity Manager, vCISO partner, and Data Privacy legal team to ensure regulatory compliance across GDPR/CCPA and data handling standards.

Qualifications

• 5-7 years in GRC, security compliance, risk management, or related security function.
• Hands-on experience owning or supporting a SOC 2 Type II audit: evidence collection and auditor coordination.
• Strong knowledge of NIST CSF: gap assessments and remediation tracking.
• Experience building or formalizing a security policy library.
• Experience managing third-party and vendor risk assessments.
• Experience responding to client security questionnaires: SIG, CAIQ, or similar formats.
• Active daily use of AI and automation in security tasks.

Responsibilities

• Own internal SOC 2 Type II evidence collection and audit readiness year-round.
• Maintain the NIST CSF remediation roadmap and coordinate with portfolio IT teams.
• Build a unified controls library mapping SOC 2 criteria to NIST CSF and regulations.
• Prepare for bi-annual NIST CSF assessments with documented controls.
• Operationalize the enterprise information security policy library across entities.
• Develop policy attestation workflows and align with Data Privacy legal team.
• Build and maintain AI governance: tool intake, data handling risk, acceptable use policy.
• Own third‑party risk management with tiered due diligence and recurring reviews.
• Manage vendor risk assessments for SASE, CASB, DLP, and AI governance tools.
• Lead GRC platform (OneTrust) deployment for vendor inventory and risk scoring.
• Respond to security questionnaires from clients and maintain response library.
• Coordinate with Cybersecurity Operations Engineer to validate control responses.

Skills

GRC

SOC 2

NIST CSF

Policy library

Vendor risk

Client security questionnaires

AI governance

Communication

Project management

Tools

OneTrust

Drata

Vanta

Whistic

Okta

Google Workspace

AWS

GCP

Azure

CrowdStrike

Job description

Momentum is seeking a Security GRC & Risk Analyst to own governance, risk, and compliance across a holding company and portfolio of businesses. You will lead SOC 2 Type II evidence collection, NIST CSF remediation, policy library management, and vendor risk programs from our Dallas office.

Collaborate with the Cybersecurity Manager, vCISO partner, and Data Privacy legal team to ensure regulatory compliance across GDPR/CCPA and data handling standards.