[Hiring] Experienced or Senior GRC Analyst @Hotman Group

Role Description

Hotman Group is looking for an experienced GRC practitioner who is ready to work directly with clients, own deliverables end to end, and contribute to a team that holds itself to a high standard. This is a full-time, remote, contract-to-hire position. Top performers move into permanent roles within 6 months.

As an Experienced or Senior GRC Analyst at Hotman Group you will work directly with clients to help them build, mature, and sustain their cybersecurity and compliance programs. This is active delivery work. You will:

• Lead assessments and audits of security and IT control environments
• Design, implement, and mature cybersecurity and compliance programs
• Develop risk registers, conduct risk assessments, and track remediation efforts
• Create and refine policies, standards, and procedures aligned with top frameworks including SOC 2, ISO 27001, NIST CSF, HIPAA, HITRUST, CMMC, and others
• Prepare clients for internal audits and external assessments
• Translate technical, regulatory, and business requirements into clear, actionable deliverables for client stakeholders
• Communicate findings, manage client feedback, and drive outcomes even when stakeholders push back
• Mentor junior analysts and contribute to the growth of our GRC practice
• Participate in peer review of deliverables before they go to clients

You will work across multiple industries on diverse engagements. No two projects are the same and no day looks exactly like the last.

Qualifications

• Hands-on GRC experience with a track record of owning deliverables, producing frameworks-based documentation, and driving remediation
• Deep working knowledge of compliance standards including SOC 2, ISO 27001, NIST CSF, HIPAA, and HITRUST
• Experience communicating findings and recommendations directly to clients or senior internal stakeholders
• Excellent writing skills
• Strong critical thinking and professional judgment
• A high level of accountability and ownership
• Comfort working independently in a fully remote environment
• A default toward communication
• Active certifications such as CISA, CISM, CISSP, or CRISC are strongly preferred

Requirements

• Permanent authorization to work in the U.S. -- no sponsorship of any kind now or in the future
• Able to pass a background check
• Reliable high-speed internet and a secure, private remote workspace

Benefits

• Work alongside people who care about the craft and push each other to do better
• Touch more GRC frameworks, more industries, and more client situations in one year than most practitioners see in five
• Grow because the work demands it
• Your name is on the deliverable

Company Description

At Hotman Group, we are not just another consulting firm. If you want to do real GRC work, get better at it every day, and work with a team that holds itself to a high standard — this is the place.