Senior Governance, Risk & Compliance (GRC) Analyst

LHH; United States; Remote; USD 83,000 - 103,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Short-term disability

401K plan

Job summary

LHH is seeking a Senior Governance, Risk & Compliance (GRC) Analyst for a fully remote contract engagement. You will lead and support GRC assessments across technology, applications, infrastructure, cloud/SaaS, business processes, and third parties.

You will assess IT and information security risk, evaluate control design and operating effectiveness, and coordinate remediation with stakeholders across IT, Finance, Legal, Privacy, and Internal Audit.

Qualifications

• 5+ years of experience in GRC, IT risk, information security assurance, IT audit, or a similar discipline.
• Hands-on experience with SOX, HIPAA, and PCI DSS.
• Strong understanding of risk assessment and risk management methodologies.
• Experience supporting internal and external audits with control owners.
• Bachelor's degree in IT, InfoSec, Accounting, Business, or related field.

Responsibilities

• Lead and support GRC assessments across technology, applications, infrastructure, cloud/SaaS environments, business processes, and third parties.
• Perform IT and information security risk assessments evaluating threats, vulnerabilities, business impact, inherent risk, residual risk, and risk treatments.
• Support compliance efforts involving SOX, HIPAA, and PCI DSS including scoping, evidence review, control testing, gap analysis, remediation, and audit readiness.
• Evaluate the design and operating effectiveness of IT and security controls, documenting exceptions and validating remediation.
• Coordinate IT general controls (ITGCs), access management, and change management activities.
• Develop risk reporting, assessment findings, metrics, and recommendations.

Skills

GRC

IT risk assessment

SOX

HIPAA

PCI DSS

IAM

ITGCs

Audit coordination

Stakeholder management

Policy development

Education

Bachelor's degree

Tools

AuditBoard

Diligent

Job description

!!!! MUST BE US CITIZEN OR GREEN CARD HOLDER TO QUALIFY !!!!

Senior GRC Analyst | Remote | Contract $60–$75/hr

We are seeking a Senior Governance, Risk & Compliance (GRC) Analyst for a fully remote contract opportunity supporting a large, regulated organization with a growing Information Security program.

This individual will join the team during an active period of growth across application readiness assessments, risk management, compliance, and security governance initiatives. The Senior GRC Analyst will help assess risk and controls, analyze findings, coordinate remediation activities, engage stakeholders, and keep multiple security and compliance priorities moving forward.

This is an excellent opportunity for an experienced GRC professional who can operate independently while partnering across Information Security, IT, Finance, Legal, Privacy, Internal Audit, and business teams.

What You'll Be Doing

• Lead and support GRC assessments across technology, applications, infrastructure, cloud/SaaS environments, business processes, and third parties.


• Perform IT and information security risk assessments, evaluating threats, vulnerabilities, business impact, inherent risk, residual risk, and appropriate risk treatments.


• Support compliance efforts involving SOX, HIPAA, and PCI DSS, including scoping, walkthroughs, evidence review, control testing, gap analysis, remediation, and audit readiness.


• Evaluate the design and operating effectiveness of IT and security controls, documenting exceptions and validating remediation.


• Support IT SOX, including IT general controls (ITGCs), application controls, risk and control matrices, and segregation of duties.


• Contribute to HIPAA security risk assessments and evaluate safeguards surrounding systems and processes handling protected information.


• Support PCI DSS readiness and scoping, including review of controls and third-party/vendor compliance evidence.


• Develop and maintain policies, standards, controls, assessment methodologies, and risk documentation.


• Map controls and requirements across frameworks including NIST CSF, NIST SP 800-53, ISO 27001, and COBIT.


• Review SOC 1/SOC 2 reports, certifications, questionnaires, and supporting evidence as part of third-party risk assessments.


• Coordinate internal and external audits, evidence requests, assessment activities, findings, and remediation efforts.


• Partner with technical and business stakeholders to turn compliance requirements and identified risks into practical, actionable controls.


• Coordinate GRC projects from planning through completion, managing milestones, dependencies, deliverables, stakeholders, and competing priorities.


• Develop clear risk reporting, assessment findings, metrics, and recommendations for both technical and business audiences.

What We're Looking For

• 5+ years of experience in GRC, IT risk, information security assurance, IT audit, or a similar discipline.


• Hands‑on experience performing or supporting assessments involving SOX, HIPAA, and PCI DSS.


• Strong understanding of risk assessment and risk management methodologies.


• Experience evaluating control design and operating effectiveness and working with stakeholders to remediate identified gaps.


• Working knowledge of:


• IT General Controls (ITGCs)


• Identity & Access Management (IAM)


• Privileged access


• Segregation of duties


• Change management


• Logging and monitoring


• Vulnerability management


• Data protection


• Business continuity and disaster recovery


• Experience creating or maintaining risk and control matrices, control narratives, policies, standards, procedures, and testing documentation.


• Ability to understand and assess controls across on-premises, cloud, and SaaS environments.


• Experience supporting internal and external audits and working directly with control owners.


• Strong project coordination, stakeholder management, communication, and organizational skills.


• Ability to independently manage multiple assessments, remediation efforts, and governance initiatives.


• Bachelor's degree in Information Technology, Information Security, Accounting, Business, or a related discipline, or equivalent relevant professional experience.

Preferred Qualifications

• CISA, CRISC, CISSP, CISM, CPA, or comparable certification.


• Experience using AuditBoard, Diligent, or similar GRC platforms.


• Experience reviewing SOC 1 and SOC 2 reports.


• Experience working within a complex or regulated enterprise environment.

Location: Remote

Type: Contract

Schedule: Full-time, 40+ hours per week with flexibility based on business needs

Function: Information Security / Governance, Risk & Compliance

Why This Opportunity Stands Out

This isn't a role focused solely on maintaining compliance documentation. The organization has a significant pipeline of security, risk, application readiness, compliance, and governance work, creating an opportunity for the right individual to make an immediate impact.

The successful candidate will combine hands‑on GRC expertise with strong project coordination and stakeholder management skills, helping translate technical risk and regulatory requirements into practical business decisions and sustainable controls.

“Benefit offerings include medical, dental, vision, life insurance, short-term disability, additional voluntary benefits, EAP program, commuter benefits, and 401K plan. Our program provides employees the flexibility to choose the type of coverage that meets their individual needs. Available paid leave may include Paid Sick Leave, where required by law; any other paid leave required by Federal, State, or local law; and Holiday pay upon meeting eligibility criteria.”

“Equal Opportunity Employer/Veterans/Disabled

To read our Candidate Privacy Information Statement, which explains how we will use your information, please navigate to https://www.lhh.com/us/en/candidate-privacy

The Company will consider qualified applicants with arrest and conviction records in accordance with federal, state, and local laws and/or security clearance requirements, including, as applicable:

• The California Fair Chance Act


• Los Angeles City Fair Chance Ordinance


• Los Angeles County Fair Chance Ordinance for Employers