GRC Analyst

The role

You will own the governance, risk, and compliance execution layer across a holding company and portfolio of businesses. This role involves managing SOC 2 Type II audits, NIST CSF remediation, security policy libraries, and vendor risk programs.

What you will do

• Own the internal SOC 2 Type II evidence collection process and manage the audit timeline.
• Own the NIST CSF remediation roadmap and coordinate with portfolio company IT teams.
• Build and maintain a unified controls library.
• Prepare the organization for bi-annual NIST CSF assessments.
• Operationalize the enterprise-wide information security policy library.
• Build and maintain annual policy attestation workflows.
• Develop and maintain the AI governance framework.
• Build and maintain a risk register with risk-to-control mapping.
• Own the third-party risk management program.
• Manage and respond to inbound security questionnaires from portfolio company clients.

Required qualifications

• 5-7 years in GRC, security compliance, risk management, or a closely related security function.
• Hands-on experience owning or supporting a SOC 2 Type II audit.
• Solid working knowledge of NIST CSF.
• Demonstrated experience building or formalizing a security policy library.
• Experience managing third-party and vendor risk assessments using a tiered risk model.
• Experience responding to client security questionnaires: SIG, CAIQ, or similar formats.
• Clear understanding of the boundary between GRC and legal/privacy functions.
• Strong written communication.
• Disciplined project management.
• Active daily use of AI and automation.

Nice to have

• GRC platforms: OneTrust, Drata, Vanta, Whistic, or similar.
• Security awareness platforms: KnowBe4 or equivalent.
• ITGC working knowledge across identity (Okta), SaaS (Google Workspace), cloud (AWS, GCP, Azure), and endpoint (CrowdStrike).
• BCP/DR frameworks: BIA methodology, RTO/RPO definition, and tabletop exercise facilitation.
• AI governance frameworks: NIST AI RMF or EU AI Act.
• Familiarity with CASB, DLP, or cloud security posture tooling from a compliance and documentation standpoint.
• Private equity, holding company, or multi-entity compliance environment experience.

Benefits

• Healthcare benefits
• 401(k) plan with an employer match
• Short-term disability coverage
• Long-term disability coverage
• Life insurance
• Paid time off
• Parental leave
• Various paid holidays

About the company

Momentum is a collection of independent companies, including PMG, Koddi, and Further. They serve as a global business transformation partner for over 125 of the Fortune 500 brands.