We are seeking an Information Security Governance, Risk and Compliance Analyst to work for our company (Ultimate Staffing is a division of Roth Staffing) on a project for a client, who is based in Boston, MA. No 3rd party candidates can be considered for this position.

Pay Rate: $50.00/hr. - $54.05/hr.

Start date: 01-11-2027; End date: 01-11-2028

Location : Boston - Pier 4; hybrid in office 2-3 days per week.

Expected Work Scheduled/Hours: Mon thru Fri 8am-5pm EST

Interview Schedule: 3 rounds total; 2 virtual, 1 on-site. Initial 30min screen and detailed 1 hour follow-up with HM. 1 hour final on-site with HM Ass. Director.

Role Summary

The Information Security Governance, Risk and Compliance Analyst supports execution of the Governance, Risk and Compliance program across the US affiliate. Reporting to the Senior Manager, Information Security Governance Risk and Compliance, this role is responsible for performing information security risk assessments, third-party security reviews, policy administration, control assurance, compliance support, remediation tracking, and operational reporting. The position works closely with IT, Legal, Privacy, Procurement, Quality, Internal Audit, business stakeholders, and Global Information Security to ensure information security risks are identified, documented, communicated, and managed in alignment with enterprise requirements. This role contributes to the development of repeatable governance, audit readiness, and risk management capabilities as the US Information Security function continues to mature. The successful candidate will bring strong analytical judgment, attention to detail, and the ability to translate risk and control information into clear documentation that supports informed decision making.

Primary Responsibilities

· Perform information security risk assessments across applications, infrastructure, business processes, projects, and third parties

· Support maintenance of the US information security risk register, risk treatment plans, remediation status, and supporting evidence

· Execute third-party security reviews and vendor risk assessments in partnership with Procurement, Legal, Privacy, and business stakeholders

· Support lifecycle management of information security policies, standards, procedures, guidelines, attestations, and exceptions

· Collect, validate, and organize compliance and control evidence for internal audits, external audits, regulatory inspections, and assurance activities

· Track remediation plans and coordinate follow-up activities with risk owners, control owners, and cross-functional stakeholders

· Support control assessments and control effectiveness reviews against information security policies, standards, and regulatory requirements

· Maintain governance, risk, and compliance documentation, repositories, metrics, dashboards, and reporting artifacts to support management visibility

· Assist with preparation of executive reporting materials, governance committee content, and risk review documentation

· Identify opportunities to improve GRC processes through standardization, automation, documentation quality, and repeatable workflows

Education and Required Skills

· Minimum of 3 years of experience in information security, cybersecurity governance, IT risk management, compliance, audit, or related disciplines

· Bachelor's degree preferred in Cybersecurity, Information Technology, Information Systems, Business, Risk Management, or a related field

· Working knowledge of cybersecurity and risk frameworks such as NIST CSF 2.0, ISO 27001, CIS Controls, PCI, SOX, FAIR, or similar standards

· Experience supporting risk assessments, compliance reviews, audits, control assurance, third-party reviews, or remediation tracking

· Strong written communication skills with the ability to develop clear documentation, reports, procedures, and stakeholder-ready materials

· Strong analytical and organizational skills with attention to detail and the ability to manage multiple priorities

· Relevant certifications such as Security+, GSEC, SSCP, CISA, CRISC, or similar certifications preferred Travel and Location

· Estimated travel required: 0-5%

· On-site in Boston preferred 1-2 days hybrid or 100% remote with occasional travel to Boston

All qualified applicants will receive consideration for employment without regard to race, color, national origin, age, ancestry, religion, sex, sexual orientation, gender identity, gender expression, marital status, disability, medical condition, genetic information, pregnancy, or military or veteran status. We consider all qualified applicants, including those with criminal histories, in a manner consistent with state and local laws, including the California Fair Chance Act, City of Los Angeles' Fair Chance Initiative for Hiring Ordinance, Los Angeles County Fair Chance Ordinance, and San Francisco Fair Chance Ordinance.