Sr. GRC Analyst

TriCom Technical Services; Overland Park (KS); On-site; USD 100,000 - 140,000; Full time

Benefits offered by this job

Low-cost employee benefits

Paid time off

Paid Holidays

401(k) with company match

Job summary

TriCom Technical Services seeks a Sr. GRC Analyst to help mature a growing security program by rewriting policies, aligning to frameworks, and shaping risk practices.

You will conduct risk assessments (NIST/ISO), interpret control requirements with IT operations, review client contracts for data security, and support third-party risk and SOC 2 audits, in a contract-to-hire role based in Overland Park, KS/NC/TX options.

Qualifications

• Bachelor's degree in Information Systems, Information Security, or related field.
• 7+ years in GRC executing or auditing against standards, frameworks, and regulations.
• Knowledge of NIST 800-53, NIST CSF, ISO 27001/27002, CIS Controls, SOC 2.
• Ability to interpret controls and connect them to operational practice.
• Experience developing security policy and standards documentation.
• Knowledge of cyber and privacy laws and regulations.

Responsibilities

• Rewrite and refresh enterprise security policies and standards, aligned to a consolidated set of frameworks.
• Conduct risk assessments using established methodology (NIST 800-30/800-37) and maintain the risk register.
• Interpret control requirements and work directly with IT operations to drive alignment and remediation.
• Review client contract provisions for data security, breach reporting, cyber resilience, and compliance certifications.
• Perform third-party/supply chain risk assessments and communicate vendor risk to business stakeholders.
• Support SOC 2 and other certification and audit efforts by collecting policy and control evidence.

Skills

GRC knowledge

NIST 800-53

NIST CSF

ISO 27001

SOC 2

Education

Bachelor's degree in Information Systems or Security

Tools

ServiceNow IRM

Job description

Sr. Governance, Risk & Compliance (GRC)Analyst

Newly created seat on a small, growing GRC team inside a global engineering and construction organization. The security program is early in its maturity curve — policies and standards are being rewritten this year, and risk assessment today is largely experiential. This role helps build that foundation: writing standards, bringing conventional risk assessment methodology to the practice, reviewing client contract security provisions, and managing third-party risk. Success here requires someone who can speak the frameworks fluently but has genuine empathy for IT operations — reading the spirit of a control, not just the letter, and partnering with operations to write policy that reflects reality.

Responsibilities

• Help rewrite and refresh enterprise security policies and standards, aligned to a consolidated set of frameworks
• Conduct risk assessments using established methodology (NIST 800-30/800-37) and maintain the risk register
• Interpret control requirements and work directly with IT operations to drive alignment and remediation
• Review client contract provisions for data security, breach reporting, cyber resilience, and compliance certifications
• Perform third-party/supply chain risk assessments and communicate vendor risk to business stakeholders
• Support SOC 2 and other certification and audit efforts by collecting policy and control evidence

Requirements

• Bachelor's degree in Information Systems, Information Security, or related field
• 7+ years in GRC executing or auditing against standards, frameworks, and regulations
• Working proficiency with NIST 800-53 (moderate baseline), NIST CSF, CIS Critical Security Controls, ISO 27001/27002, and AICPA SOC 2
• Demonstrated ability to interpret controls and connect them to operational practice — beyond coordinating audit evidence
• Experience developing security policy and standards documentation
• Working knowledge of cyber and privacy laws and regulations

Preferred

• Experience in a regulated environment
• Familiarity with FAR, DFARS, CMMC
• ServiceNow IRM or comparable GRC platform (shallow learning curve — training available)
• CRISC, CISSP, or comparable certification

This is a 6-Month Contract-to-Hire opportunity to sit in Overland Park, KS, Cary, NC, or Houston, TX with our Overland Park, KS client.

• Low-cost employee benefits
• paid time off
• paid Holidays
• a 401(k) (with an immediately vested company match) are available with TriCom during the contract period.
• H-1B visa sponsorship is not available for this position.
• No third parties, please.