SOC 2 & GovRAMP GRC Analyst — Remote

Infotech; Gainesville (FL); Remote; USD 85,000 - 110,000; Full time

Benefits offered by this job

Health benefits

Flexible time off

Continuing education programs

Inclusive culture

Job summary

Infotech is seeking a GRC Analyst to run day-to-day SOC 2 Type II and GovRAMP activities, coordinating across engineering, IT, and business teams to collect evidence, document controls, and close gaps.

You will own evidence collection, support GovRAMP assessments, draft security policies, and administer compliance tooling to streamline audits while communicating clearly with auditors and executives.

Qualifications

• 5+ years of experience in GRC, security compliance, or IT audit.
• Ownership of at least one full SOC 2 Type II audit cycle or GovRAMP assessment.
• Experience writing security policies and control documentation.
• Coordinate deliverables across several teams with minimal direction.
• Familiarity with policy as code and related tooling.
• Clear communication with auditors, engineers, and executives.
• Ability to lead, investigate, and coordinate security incidents.
• Experience with GovRAMP/StateRAMP/FedRAMP programs (nice to have).

Responsibilities

• Own SOC 2 Type II evidence collection and readiness for each audit cycle.
• Support GovRAMP assessments including POA&M and continuous monitoring.
• Draft and maintain security policies and control narratives aligned with SOC 2 and NIST SP 800-53 Rev 5.
• Administer Vanta/Drata and automate evidence collection to reduce manual work.
• Perform risk and third-party assessments; verify AWS technical controls.
• Coordinate penetration tests and track findings to closure.
• Provide backup coverage for audit and assessment activity.

Skills

GRC experience

Security compliance

IT audit

Policy coordination

Open Policy Agent

Education

CISA

CISSP

CISM

CGRC

Tools

Vanta

Drata

AWS Config rules

Job description

Infotech is seeking a GRC Analyst to run day-to-day SOC 2 Type II and GovRAMP activities, coordinating across engineering, IT, and business teams to collect evidence, document controls, and close gaps.

You will own evidence collection, support GovRAMP assessments, draft security policies, and administer compliance tooling to streamline audits while communicating clearly with auditors and executives.