Title: Governance and Risk Compliance Specialist (GRC)
Location: Boston, MA or New York City
Schedule: Hybrid; two days onsite per week
Employment Type: contract-to-hire
Rate: $50-$60/hour


The Planet Group has partnered with a Boston based company to locate a  GRC Security Analyst to support information security governance, risk, and compliance activities. This role combines policy development, audit support, application access reviews, vulnerability tracking, and security reporting.

The role can also be based in New York but does still require two days a week onsite in Manhattan.

The successful candidate will work  with Security, Cybersecurity Engineering, Infrastructure, and application owners to keep documentation current, track security issues, and turn information from multiple sources into clear reporting for management.

Responsibilities

• Develop and maintain information security policies, procedures, and supporting documentation aligned with established frameworks and business requirements.
• Coordinate audit requests, gather evidence, and work with internal teams to provide accurate, timely responses to external auditors.
• Support data protection, privacy, and information security compliance initiatives.
• Conduct periodic application access reviews, validate user permissions, and maintain access records.
• Assist with documentation and provisioning processes for new applications and users.
• Review vulnerability scan results and organize findings by severity, affected device, and application.
• Coordinate with application owners and Infrastructure teams to track remediation progress, follow up on outstanding findings, and escalate concerns.
• Consolidate security metrics from multiple sources into clear management reports and executive summaries.
• Identify and communicate security and risk trends, remediation priorities, and outstanding issues.
• Support security awareness training and maintain completion and activity reporting.
• Participate in security and management meetings, providing updates on progress, risks, and open items.
• Help improve security processes, documentation, and reporting across IT teams.

• Experience in information security, governance, risk, and compliance, or a related cybersecurity function.
• Experience developing and maintaining security policies, procedures, and compliance documentation.
• Background supporting security audits, including evidence collection and coordination of audit requests.
• Understanding of application access governance, user access reviews, and access documentation.
• Experience reviewing security reports, tracking vulnerabilities, and coordinating remediation activities.
• Strong analytical skills and the ability to turn data from multiple sources into clear, actionable reporting.
• Strong written and verbal communication skills, including the ability to explain security findings to technical teams, business stakeholders, and management.
• Excellent organizational skills, attention to detail, and the ability to manage competing priorities.
• A proactive approach to problem-solving, stakeholder follow-up, and process improvement.
• Ability to collaborate across Security, Engineering, Infrastructure, and other IT teams.
• Must be located in the Boston or New York City area and available to work onsite two days per week.

• Familiarity with security frameworks and standards such as NIST, ISO 27001, and Cyber Essentials.
• Experience with Qualys for vulnerability management and remediation tracking.
• Familiarity with KnowBe4 or similar security awareness training platforms.
• Exposure to CrowdStrike, Bitdefender, Microsoft Intune, or Jamf.
• Experience with Clarity Security or similar identity and access governance platforms.
• Knowledge of data protection, privacy, and information security risk management practices.
• Experience preparing executive-level security metrics, dashboards, and compliance reports