Information Security GRC Analyst – Application Security

Quantam Solutions provides IT solutions and consulting for various clients. We offer competitive hourly wages, health benefits, paid time off, and a 401(k) plan. We are currently seeking an Information Security GRC Analyst. This role offers a hybrid work location schedule in accordance with our client’s telework policy, suited for individuals who can be present on-site weekly in Frankfort, KY.

Location: Frankfort, KY 40601

Work Arrangement: Hybrid (3 Days Onsite / 2 Days Remote)

Experience Required: 4–7 Years

Job Description

Our client is seeking an experienced Information Security GRC Analyst to support information security governance, risk management, and compliance initiatives. The ideal candidate will have strong experience developing and maintaining security policies, coordinating security audits, conducting risk assessments, and ensuring compliance with industry standards and regulatory frameworks.

This role requires a combination of Governance, Risk, and Compliance (GRC) expertise and technical security knowledge, including vulnerability management, application security, and security control assessments.

The successful candidate will work closely with technical teams, business stakeholders, and external auditors to strengthen security controls, manage compliance requirements, and support ongoing security improvements.

Key Responsibilities

Information Security Governance & Policy Management

• Develop, review, and maintain information security policies, standards, and procedures aligned with NIST, ISO 27001, CIS, and other applicable frameworks.
• Collaborate with IT, Legal, HR, and other stakeholders to ensure security policies are implemented and followed.
• Maintain policy documentation, version control, and review cycles.
• Support security governance initiatives and compliance reporting.

Security Audits & Compliance

• Coordinate and support internal and external security audits, assessments, and compliance inquiries.
• Gather, organize, and maintain audit evidence and supporting documentation.
• Assist with SOC 2, ISO 27001, and other regulatory or compliance assessments.
• Track audit findings, corrective actions, and remediation activities through resolution.
• Identify compliance gaps and recommend improvements.

Risk Management & Vulnerability Assessment

• Participate in information security risk assessments and security control gap analyses.
• Coordinate penetration testing and vulnerability scanning activities with technical teams.
• Review, interpret, and communicate vulnerability assessment findings.
• Track risk remediation plans and corrective actions.
• Maintain risk assessment documentation and compliance reports.

Application & Technical Security

• Evaluate application security controls and identify potential security risks.
• Demonstrate knowledge of OWASP Top 10 vulnerabilities and application-layer threats.
• Review API security controls, including OAuth 2.0 and OpenID Connect.
• Assess container security practices and associated risks.
• Review CI/CD pipeline configurations using tools such as Jenkins, GitHub Actions, or Azure DevOps for security control compliance.
• Evaluate secrets management practices involving tools such as HashiCorp Vault and AWS Secrets Manager.
• Collaborate with development and infrastructure teams to address security findings.

Security Awareness & Collaboration

• Support the development and delivery of security awareness training.
• Promote security best practices and policy compliance across the organization.
• Communicate security risks, audit findings, and compliance requirements to technical and non-technical stakeholders.

Required Qualifications

• 4–7 years of experience in Information Security, Cybersecurity GRC, IT Risk Management, or Security Audit and Compliance.
• Experience developing and maintaining information security policies, standards, and procedures.
• Strong understanding of security frameworks and regulations such as NIST 800-53, ISO 27001, SOC 2, HIPAA, PCI-DSS, or GDPR.
• Hands-on experience supporting security audits, compliance assessments, and audit evidence collection.
• Experience conducting risk assessments, control gap analyses, and remediation tracking.
• Familiarity with vulnerability scanning, penetration testing findings, and vulnerability management processes.
• Understanding of OWASP Top 10, API security, container security, and application security controls.
• Knowledge of CI/CD security practices and secrets management.
• Excellent technical writing, documentation, analytical, and organizational skills.
• Strong communication skills with the ability to interact with technical teams, business stakeholders, and executive management.
• Familiarity with Agile methodologies.
• Ability to work independently, manage competing priorities, and meet deadlines.
• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, or a related field, or an equivalent combination of education and experience.

Preferred Qualifications

• Certifications such as CISSP, CISA, CISM, Security , or ISO 27001 Lead Implementer.
• Experience working in government, public sector, or highly regulated environments.
• Experience with security compliance reporting and audit remediation.
• Familiarity with Jenkins, GitHub Actions, Azure DevOps, HashiCorp Vault, or AWS Secrets Manager.
• Experience collaborating with cross-functional security, infrastructure, and application development teams.

Work Arrangement

This is a hybrid contract opportunity based in Frankfort, KY, with an expected schedule of three days onsite and two days remote per week. Wednesday is a designated onsite day. The work arrangement is subject to client policies and business needs.