Senior Governance, Risk & Compliance Analyst (Cybersecurity)

Location: Illinois, United States; hybrid/remote

Salary: $90,000–$136,000 per year, plus annual performance bonus and long-term incentives

Company

hirify.global operates in the security and information technology sector.

What you will do

• Execute second-line governance, risk, and compliance activities, continuously assessing control adequacy and effectiveness.
• Maintain assigned security policies, standards, risk register entries, Risk and Control Matrix items, framework mappings, deficiencies, exceptions, and remediation tracking.
• Perform IT risk analysis, ITGC testing, control design and validation, evidence correlation, and automated control testing across known systems and patterns.
• Partner with engineering, product, business, Security Engineering, IT, and audit stakeholders to interpret requirements, implement controls, and secure remediation commitments.
• Support integrated audits and SOX readiness activities, including SOX, ISO 27001, SOC 2, and FedRAMP reviews, and provide risk metrics and maturity reporting to leadership.
• Support pre-assessment reviews of FedRAMP Moderate and/or High authorization packages, validating evidence completeness and identifying gaps before AO and 3PAO reviews.

Requirements

• 4+ years of professional experience in IT audit, risk management, or compliance, including hands-on ITGC testing.
• Working knowledge and experience with NIST CSF 2.0, NIST 800-53, ISO/IEC 27001, AICPA Trust Services Criteria/SOC 2, COSO, COBIT and/or FedRAMP, including requirement translation and common-control cross-walking.
• Advanced-tier GRC certification, such as CRISC, CGRC, CIA, ISO/IEC 27001 Lead Auditor or Lead Implementer, or GSNA.
• Experience maintaining and testing Risk and Control Matrices and framework mappings with Security Engineering, IT, and Product teams.
• Understanding of the Three Lines Model and demonstrated experience executing second-line control testing, including deficiency evaluation and documentation.
• Working knowledge of IT and security general controls covering change management, access to programs and data, segregation of duties, asset management, computer operations, encryption, secure systems development, application controls, and data integrity.
• Experience with GRC technologies, AI tooling, audit-ready documentation, and presenting testing results and remediation recommendations to technical and non-technical stakeholders.
• Strong problem-solving, critical-thinking, written and verbal communication skills; ability to manage competing priorities and complete assigned work.
• Ability to gain and maintain relevant U.S. federal clearances.

Nice to have

• Experience supporting FedRAMP Moderate or higher authorization and continuous monitoring, and/or Big Four or comparable IT audit experience.
• Technical proficiency with Python, PowerShell, SQL, or a similar scripting or query language.
• Experience building automated workflows to and from GRC systems, using automated evidence collection, or operating continuous control monitoring tools.
• Experience interacting directly with external auditors or assessors.
• Experience providing peer review or guidance to less experienced analysts.

Culture & Benefits

• Hybrid/remote work arrangement in the United States.
• Competitive base salary with an annual performance bonus and long-term incentives.
• Compensation practices are described as competitive, fair, and equitable.