Governance, Risk, and Compliance (GRC) Analyst

Please make sure your application is complete, including your education, employment history, and any other applicable sections. Initial screening is based on the minimum requirements as defined in the job posting, such as education, experience, licenses, and certifications. Your experience should also address the knowledge, skills and abilities needed for the role. Incomplete applications will not be considered.

*This position is located Remote, Anywhere US *

*Due to being a federal contractor, you may be subject to obtaining and maintaining a public trust security clearance from the federal government. *

Position Purpose:

  Executes governance, risk, and compliance activities by monitoring adherence to regulatory, contractual, and policy requirements, conducting assessments, managing control evidence, and performing third‑party risk reviews. 

Essential Responsibilities:

• Administers ongoing third-party vendor risk assessments using structured supply chain and security review processes, consistent with National Institute of Standards and Technology (NIST) and organizational Third-Party Risk Management (TPRM) policies.


• Reviews vendor SOC reports, security attestations, cloud authorization artifacts, network diagrams, and compliance certifications.


• Supports ATO (Authorization to Operate), re authorization, and external audit engagements (CMS, GSA, federal partners, internal QA).


• Conducts initial and recurring vendor assessments to evaluate security posture, misconfiguration risks, data handling practices, and alignment with contractual requirements.


• Tracks exceptions, deviations, and risk acceptances through proper governance channels.


• Assists system owners in developing Plan of Action and Milestones (POA&Ms) based on assessment findings; tracks remediation status and ensures timely closure.

Minimum Qualifications

Education

• Bachelor's degree from an accredited college or university




•  Additional experience in an information technology system and network role or other related areas may be substituted for Bachelor’s degree on a year per year basis. (Experience requirements may be satisfied by full-time experience or the prorated part-time equivalent.)

Certification

• Have or obtain a professional security certification such as Certified Information Systems Auditor (CISA), Certified in Risk and Information Systems Control (CRISC), Certified in Governance, Risk & Compliance (CGRC), Certified Third‑Party Risk Professional (CTPRP), Cyber Supply Chain Risk Professional (CSCRP), Certified Information Privacy Manager (CIPM), within 1 year of employment or promotion

Experience

• One (1) year in Third Party Risk Management, GRC, or supporting enterprise security/compliance programs

Benefits

TMF offers an excellent benefits package, including:

• Medical, dental, vision, life, accidental death and dismemberment, and short and long-term disability insurance


• Section 125 plan


• 401K


• Competitive salary


• License/credentials reimbursement


• Tuition Reimbursement

EOE Vet/Disability