Governance, Risk & Compliance (GRC) Analyst

What you'd do

• Own risk assessments across several departments and maintain the centralized risk register.
• Design and maintain a unified, original control framework tailored to CHAOS Industries' operating environment, including a security-by-design approach to systems development and defined: Maximum Tolerable Downtime (MTD), Recovery Point Objective (RPO), and Recovery Time Objective (RTO) for critical systems.
• Write and maintain policy that goes beyond minimum mandatory compliance, building genuine security maturity rather than satisfying the floor of any one requirement.
• Manage GRC tooling and related workflows to support risk assessments, control monitoring, and reporting.
• Prepare for, coordinate, and help run third-party and certification audits, including evidence collection, gap assessments, and auditor liaison.
• Act as the connective tissue between different department to then develop security and compliance requirements for partner teams and drive them to execution.
• Report regularly to the Program Director and executive stakeholders on risk posture, audit status, and program maturity.
• Onsite presence required 4 days per week.
• Travel: up to 25%, primarily to support Manufacturing and Physical Security control validation across company sites.
• Physical demands: occasional access to manufacturing floor environments, including required PPE and periods of standing or walking during facility walkthroughs.

What they want

• Bachelor’s degree or equivalent experience in computer science, cybersecurity, information security, Information Technology, Information Assurance, or a related field, or equivalent practical experience.
• Deep knowledge of NIST CSF, NIST RMF, the ISO/IEC 27000 series, UK Cyber Essentials, CMMC/NIST 800-171, NIST 800-53.
• Experience selecting, implementing, or administering GRC tooling and workflows.
• Exposure to widely recognized governance, risk, and compliance frameworks spanning security, privacy, and quality management domains.
• Familiarity with OT/ICS security concepts.
• Minimum of 5 years hands-on GRC or compliance experience combined with prior experience in a DoD environment or military service.
• Has directly supported a third-party or certification audit from evidence collection through closure.
• Can apply recognized governance, risk, and compliance frameworks well enough to design real, working controls tailored to a specific organization, not just describe them generically.
• Has performed or directly supported a formal risk assessment (identification, scoring, and treatment) using a defined methodology.