Cybersecurity / GRC Analyst – NIST CSF 2.0

About the Role

We are building a formal cybersecurity program aligned with the
NIST Cybersecurity Framework (CSF) 2.0
to support commitments to enterprise customers and prospects.

The initial gap assessment has already been completed and the remediation work has been translated into a defined task list. We are looking for a hands-on
Security / GRC Analyst
who can take ownership of that plan and drive it through completion.

This is not a purely advisory role. You will personally execute a significant portion of the remediation, control implementation and documentation work while coordinating activities across IT, Engineering and business teams.

You will be responsible for tracking owners, timelines, dependencies, risks and evidence until each item is formally closed. Success in this role will be measured by
completed remediation activities, implemented controls and defensible evidence
, rather than hours logged.

Our environment is primarily
cloud and SaaS-based
, so hands-on experience with cloud security controls and third-party/vendor risk is essential.

What You’ll Do

Security & GRC Execution — approximately 50–60%

• Draft, update and support approval of security policies, standards and procedures aligned with
  NIST CSF 2.0 Categories and Subcategories
  , with particular focus on the
  Govern
  function.
• Configure, validate and document security controls within cloud and SaaS environments, including access management, logging and monitoring, configuration baselines and data protection.
• Collect, organize and quality-check security evidence to ensure completed controls can be demonstrated to customers, auditors or assessors.
• Maintain
  Current and Target NIST CSF Organizational Profiles
  and corresponding control mappings.
• Map security requirements against customer questionnaires and contractual commitments.
• Conduct cloud, SaaS and third-party/vendor risk assessments and track remediation activities.
• Support Sales and Account teams with enterprise security questionnaires, RFP responses and customer due-diligence activities.

Project Management — approximately 40–50%

• Convert the existing remediation task list into a structured project plan with owners, timelines, dependencies and critical paths.
• Coordinate recurring working sessions with stakeholders across IT, Engineering and Operations.
• Identify and remove blockers and escalate risks or dependencies when necessary.
• Provide concise weekly progress reports to the VP of Engineering & Operations.
• Track progress by NIST CSF Function, including risks, decisions required and forecast completion dates.
• Maintain the program risk register and security exception/risk acceptance process.
• Establish documented and repeatable processes that the internal team can continue after the engagement ends.

Required Qualifications

• 3–6 years of hands-on experience
  in Information Security, IT Risk, Cybersecurity Governance or GRC.
• Direct participation in at least one security framework implementation, remediation initiative or audit/compliance program involving frameworks such as: NIST CSF, NIST 800-53, ISO 27001, SOC 2, CIS Controls or a comparable framework.
• Working knowledge of
  NIST CSF 2.0
  , including: Govern, Identify, Protect, Detect, Respond, Recover
• Understanding of NIST CSF Categories, Subcategories, Implementation Tiers and Organizational Profiles, or demonstrated ability to quickly become proficient in comparable frameworks.
• Hands-on experience securing
  cloud and SaaS environments
  , preferably AWS, Azure or GCP.
• Experience reviewing and validating security configurations in cloud or SaaS administrative consoles.
• Demonstrated project management skills managing multiple workstreams and distributed stakeholders.
• Strong technical writing skills, including security policies, procedures and executive/status reporting.
• Ability to translate security and compliance requirements into actionable tasks for Engineering, IT and business teams.
• Ability to work independently with limited supervision and demonstrate measurable progress quickly.

Preferred Qualifications

• Security certification such as: CISSP, CISA, CRISC, CISM, Security+, CCSP, CCSK (AWS Security Specialty, Azure SC-100)
• PMP, CAPM or equivalent project management training.
• Experience completing enterprise customer security assessments and vendor due-diligence questionnaires.
• Experience with GRC or compliance management platforms.
• Experience using scripting or automation for security evidence collection.
• Experience in media, content identification or other data-intensive technology environments.

How to Apply

Submit a resume and a short note describing a framework or compliance program you personally drove to completion — what the scope was, what you built yourself versus coordinated, and how you knew you were done.

Engagement Details

• Contract: Full-time contract
• Schedule: 40 hours per week
• Location: Remote – United States (Residents of California and Texas)
• Working hours: Pacific Time business hours