GRC Analyst

Job Title: GRC Analyst

Location: Onsite/ Salt Lake County

Job-Type: 6+ Month Contract

Salary Range : $65.00- $80.00

Job Summary

We are seeking a detail-oriented Governance, Risk & Compliance (GRC) Analyst to support and strengthen the organization's information security governance, risk management, and compliance practices. This individual will work closely with existing security and IT personnel to review audit findings, identify gaps in current policies and procedures, and develop clear, actionable documentation to address identified risks.

The ideal candidate has experience analyzing security and compliance gaps, developing and revising policies and procedures, documenting remediation plans, and translating technical security requirements into practical guidance that can be understood and implemented by both technical and nontechnical employees.

This is a hands-on role focused on moving beyond identifying issues to developing sustainable policies, procedures, and remediation practices that can be adopted throughout the organization.

Key Responsibilities

• Review and analyze existing audit findings, security assessments, and compliance documentation to identify gaps, risks, and areas requiring remediation.
• Evaluate current information security policies, procedures, standards, and controls to identify inconsistencies, deficiencies, and missing documentation.
• Develop actionable recommendations and remediation plans to address audit findings and improve security and compliance practices.
• Rewrite and update existing security policies and procedures to align with organizational requirements, industry best practices, and applicable regulatory standards.
• Create new policies, procedures, standards, and supporting documentation where gaps or deficiencies exist.
• Translate audit findings and security requirements into clear, structured requirements documents, remediation plans, and management reports.
• Develop documentation that clearly communicates security expectations, responsibilities, and implementation steps to technical teams, business stakeholders, and end users.
• Collaborate with IT, information security, compliance, and business teams to validate requirements and ensure proposed policies and procedures are practical and implementable.
• Help establish consistent documentation practices and repeatable processes for addressing audit findings and maintaining ongoing compliance.
• Track remediation activities, document progress, and support the development of evidence demonstrating that identified issues have been addressed.
• Recommend improvements to governance processes, policy management, risk documentation, and internal controls.

Required Qualifications:

• Experience in Governance, Risk & Compliance (GRC), information security, IT risk management, audit remediation, or related discipline.
• Demonstrated experience reviewing audit findings and translating identified gaps into actionable remediation plans.
• Strong experience writing, revising, and maintaining security policies, procedures, standards, and requirements documentation.
• Ability to analyze existing documentation, identify deficiencies, and develop practical recommendations for improvement.
• Excellent technical writing, documentation, and communication skills.
• Ability to communicate complex security and compliance concepts in clear, understandable language for technical and nontechnical audiences.
• Strong analytical, organizational, and problem-solving skills.
• Ability to work independently, manage multiple priorities, and collaborate with stakeholders across the organization.

Preferred Qualifications

• Experience supporting internal or external audits and compliance assessments.
• Familiarity with information security frameworks and standards such as NIST Cybersecurity Framework, NIST SP 800-53, ISO 27001, SOC 2, or CIS Controls.
• Experience with risk assessments, control documentation, corrective action plans, and evidence collection.
• Familiarity with policy management, risk registers, control mapping, and compliance tracking.
• Experience working in an environment with an established but lean information security or GRC function.

Employment Eligibility: Gravity cannot transfer nor sponsor a work visa for this position. Applicants must be eligible to work in the U.S. for any employer directly (we are not open to contract or “corp to corp” agreements).