Senior GRC Analyst

As a Senior GRC Analyst, you will support assessment and audit readiness, cloud security compliance, risk management, and security tooling across SaaS and cloud environments. You will ensure controls are well documented, measurable, continuously monitored, and aligned with applicable frameworks, laws, and regulations. This role supports customer trust by delivering clear audit evidence, accurate reporting, and effective remediation in partnership with Engineering, Product, and IT.

Reporting to the GRC Manager, you will operate with minimal supervision, drive cross-functional accountability, and own key deliverables from initial assessment through audit completion and remediation closure.

You will develop a strong understanding of the control environment and audit calendar, establish a consistent evidence-request process with stakeholders, and deliver audit-ready evidence packages and control updates from start to finish. Responsibilities include maintaining control narratives and SSPs, preparing evidence packages, tracking PoA&Ms, supporting audit kickoffs and debriefs, and developing executive-ready dashboards and status reporting.

You will also own audit readiness for SaaS and cloud products across key frameworks, including SOC 2, NIST 800-53/171, ISO 27001, and FedRAMP, leading evidence collection and control documentation, partnering with Engineering and Product teams, and providing clear visibility into risk, audit findings, and remediation progress.

Audit & frameworks

• Lead or support audits & assessments for cloud SaaS applications across frameworks such as SOC 1, SOC 2, NIST 800-53, NIST 800-171, CMMC, ISO, FedRAMP, PCI DSS, CIS, CSA CCM, & other security or regulatory standards/frameworks.
• Manage scoping, evidence requests, control testing, issue tracking, remediation follow-up, & final report support.
• Assess & communicate administrative, technical, & security controls across OCI, AWS, Azure, & related cloud services.
• Apply project management practices to plan, track, & deliver assessments, including use of Jira for epics, stories, backlog management, & stakeholder reporting.

• Use automation & AI responsibly to streamline evidence collection, control mapping, & recurring reporting, with appropriate human review.

• Build & maintain GRC metrics & dashboards for reporting.
• Present trends, risks, remediation status, & control health to leadership.
• Draft & maintain security policies, standards, System Security Plans, control narratives, implementation details, & evidence references.
• Produce high-quality audit deliverables, including narratives, evidence packages, status reports, & remediation updates.
• Manage risk register items & PoA&Ms from identification through closure, including control gap analysis, remediation planning, owner coordination, & progress tracking.
• Translate control requirements & regulatory obligations into clear, testable expectations for technical teams.

Program ownership & documentation

• Own or backup for key GRC programs by maintaining procedures, SLAs, & artifacts for audits & customer requests (e.g., policy management & security due diligence questionnaires to support RFIs & RFPs).
• Actively participate in initiatives aimed at enhancing team processes & procedures.
• Help maintain & curate annual compliance training content & improve training process.
• Interpret control requirements & regulatory obligations accurately, & translate them into clear, testable expectations for technical teams.
• Participate in incident response reviews & RCAs by documenting control failures, corrective actions, & follow-up evidence for closure.

Technical Requirements
Senior-level expectation includes independently leading audit workstreams, driving stakeholder follow-through, and owning evidence/control documentation through completion (years of experience are a guideline, but demonstrated scope and impact are key).

• US Citizen is required for this position due to the nature of the work
• B.S. degree (Information Security, Computer Science, MIS, or equivalent program preferred) from an accredited college/university.
• 3+ years supporting audits & compliance work across common frameworks (see framework list above), with demonstrated evidence collection, control testing, & remediation tracking.
• Minimum 3 years of combined experience with implementing and/or assessing: IT audit, IT risk management, Cloud security & compliance, internal audit function, Information Technology General Controls (ITGC), Information security operations.
• Experience supporting government-related compliance efforts (e.g., FedRAMP- or DoD-aligned expectations) within cloud environments, including evidence packaging & stakeholder coordination.
• Hold (or be actively pursuing) relevant certifications such as CISA, CISSP, CCSK/CCAK, or major cloud security certifications (Azure/AWS/GCP), with active status preferred.

Core Competencies

• Work independently, exercise good judgment & proactively seeks guidance as needed.
• Manage time effectively across multiple priorities & concurrent projects.
• Demonstrate strong analytical & critical-thinking skills with business & technical acumen.
• Communicate clearly in writing, verbally & collaborate effectively with diverse stakeholders.
• Thrives in a fast-paced, collaborative environment & contribute to shared outcomes.
• Follow directions from senior staff & supports peers to deliver high-quality, time-bound work.
• Continuously learn through structured, on-the-job, & self-directed development.

Preferences

• CCAK/CCSK, CISSP, CISA, or other related information security certification desired.
• Demonstrable FedRAMP, ISO & SOC Security Framework experience desired.
• Experience with effective AI usage, data analysis, report preparation, automation, & templating of repeat processes.

The U.S. salary range for this position is $76,000.00-$134,000.00. This range is subject to change as Deltek takes a number of factors into consideration when determining individual base pay, such as location, job-related knowledge, skills and experience. Certain roles are eligible for additional rewards, including incentive compensation and equity.

Benefits and perks listed here may vary depending on the nature of employment with Deltek. Employees have access to healthcare benefits, a 401(k) plan and company match, paid vacation time and holidays, well-living programs, short-term and long-term disability coverage, basic life insurance and tuition reimbursement.

10%