GRC (Governance Risk and Compliance) Analyst

Annual Salary Range $106,380.00 - $130,020.00 USDbased on experience

The ideal candidate for the GRC Analyst position would use their skills and experience to ensure the compliance of Colas' GRC program against selected compliance frameworks. Your focus will be in collection of evidence, updating compliance policies, and identifying non-conformance with established policies . You will also be helping implement newly identified compliance frameworks and work to improve operational efficiency within the Colas GRC program

o GRC Ownership: Own the GRC efforts to improve and maintain adherence with selected compliance frameworks (Primarily NIST 800-171 in accordance with CMMC L2 requirements)
o Cybersecurity Audits: Identify non-compliant systems and provide recommendations for remediations.
o Incident Response: Help investigate security breaches and implement mitigation strategies.
o Documentation and Reporting: Maintain comprehensive documentation of the information technology environment.
o Auditing: Periodically audit compliance with our cybersecurity processes.
o Evidence Collection: Collect required evidence to demonstrate Colas is remaining compliant with selected compliance frameworks
o Provide mentorship and strategic guidance to IT teams, translating complex regulatory requirements into actionable technical steps for seamless compliance execution.
o Training: help train internal Colas ISS users on best cybersecurity practices.
o Emerging Technologies: Stay updated with the latest advancements in security technologies and recommend relevant solutions to enhance our security.

o Communication Skills: The ability to convey complex technical concepts to both technical and non-technical stakeholders.
o Collaboration: Working effectively with cross-functional teams, including developers, project managers, and business analysts.
o Problem-Solving: Analyzing issues and developing effective solutions while considering various constraints and trade-offs.
o Leadership: Guiding and mentoring team members and influencing decision-making processes within the team and organization.
o Adaptability: Being open to change and able to adjust to new technologies, tools, and methodologies as they emerge.
o Critical Thinking: Evaluating options and making informed decisions based on analysis and reasoning.
o Time Management: Prioritizing tasks effectively to meet deadlines while balancing multiple projects.
o Empathy: Understanding the perspectives and challenges of team members and stakeholders, which helps in fostering a collaborative environment.

o Bachelor's degree in computer science or similar
o Minimum of 5 years experience with maintaining compliance frameworks (NIST 800-171 experience required)
o Apply advanced technical knowledge and analysis of specialized functional areas in task requirements to develop solutions to complex problems.
o Experience with Microsoft 365 GCC environments
o Positive attitude and strong work ethic
o Exceptional written, verbal & listening communication skills
o Willing and able to travel in US & Canada 2-3 times per year

o Technical Experience in triaging security alerts (EDR, AV, SIEM)
o Experience in a Cloud Infrastructure environment (Azure - preferred, AWS)
o One or more current security related certifications (e.g., CISSP, SANS GIAC, etc.)
o One or more cloud security certifications (Azure, AWS, GCP, CCSP)