Governance, Risk & Compliance (GRC) Analyst – State Agency – $40-46/hr W2 – Phoenix Hybrid – Contract-to-Hire

Governance, Risk & Compliance (GRC) Analyst – State Agency – $40-46/hr W2 – Phoenix Hybrid – Contract-to-Hire

SunSoftOnline is hiring a GRC / Information Security Analyst for an Arizona state agency's technology division, a 4-month contract-to-hire (the goal is conversion to a permanent state position), hybrid in Phoenix with participation in the State's remote work program.

Hard requirements, read before applying:

• NIST 800-53 R5 working knowledge (must-have, on your resume)
  
• Risk Management Framework (RMF) experience · Windows/Unix environment experience
  
• Familiarity with IRS Pub 1075, HIPAA/HITRUST, CJIS, and MARS-E compliance frameworks
  
• Bachelor's degree (required)
  
• Living within ~1 hour of Phoenix, city on your resume
  
• Eligible to convert to a permanent full-time employee: U.S. citizen or green card holder; the state cannot sponsor visas, and time-limited work authorization does not qualify for this contract-to-hire role
  

The work: performing risk assessments and audit reviews; generating findings reports, POA&Ms, and non-compliance documentation; reviewing and managing security plans, audit plans, and risk documentation; investigating suspicious network activity and generating incident reports; researching security standards, laws, and regulations to ensure compliance; and working across business units on requirements, data flows, and enterprise information policies. Preferred: project management experience; CISSP, CCSP, GSTRT, GSNA, or CAP certification.

The facts: $40-46/hr W2 depending on experience · Monday-Friday days · hybrid Phoenix (state remote-work program participation) · 4-month contract-to-hire · in-person interview within a week of the close · start within two weeks of offer · HireRight background check and drug screening.

Apply with your resume showing your current city, and make sure your genuine framework experience (NIST 800-53, RMF, Pub 1075, HITRUST, CJIS, MARS-E) appears on it by name, the review process matches your resume to the posting's own language. Closes Tuesday, August 18.