GRC Analyst

As a Sr. GRC Analyst for Oceaneering you will support the organizations cybersecurity governance risk management compliance and security assurance programs. You will partners with business units IT OT legal and regulatory stakeholders to implement security controls maintain compliance with industry and government requirements reduce cyber risk and protect critical company information assets.

*Role provides the opportunity to work in a hybrid environment working both virtually and in the Houston office when required

• Develop maintain and enhance cybersecurity policies standards procedures and governance frameworks.
• Conduct cybersecurity risk assessments and coordinate mitigation activities.
• Support compliance initiatives including NIST CMMC Cyber Essentials ISO standards FedRAMP UK government requirements and customer security assessments.
• Lead responses to customer supplier and regulatory cybersecurity questionnaires and audits.
• Review system architectures cloud solutions and operational technology environments for security requirements and compliance impacts.
• Coordinate vulnerability management corrective action tracking and remediation activities.
• Support incident response investigations and security event escalation processes.
• Manage cybersecurity documentation evidence collection and audit readiness activities.
• Collaborate with business units engineering teams and project stakeholders to incorporate security requirements into projects and operational processes.
• Evaluate third-party and supply chain cybersecurity risks.
• Provide cybersecurity guidance awareness and training to internal stakeholders.
• Support data protection initiatives including CUI ITAR EAR and sensitive information handling requirements.

*As a position necessitating ITAR Regulation Compliance Permanent Resident or US Citizen Status is required

Required Qualifications

• Bachelors degree in Cybersecurity Information Technology Computer Science or related field (or equivalent experience).
• Minimum 5 years of cybersecurity risk management compliance governance or information security experience.
• Minimum 5 years with:
  • NIST SP 800-53 or NIST SP 800-171
  • CMMC
  • Risk Management Framework (RMF)
• Minimum 5 years of with security assessments audits and control implementation.
• Minimum 3 years of cloud security identity management endpoint protection vulnerability management and security monitoring.
• Strong technical writing and documentation skills.
• Ability to communicate cybersecurity requirements to both technical and non-technical audiences.
• US Citizen or permanent resident (ITAR compliance)

Preferred Qualifications

• CISSP CISM CRISC Security CGRC or equivalent certification.
• Experience supporting government defense energy or critical infrastructure environments.
• Knowledge of operational technology (OT) and industrial control system (ICS) security.
• Experience with Cyber Essentials / Cyber Essentials Plus ISO 27001 CIS Controls Microsoft 365 security Microsoft Purview Microsoft Defender Entra ID and cloud governance platforms.
• Understanding of data classification export control and regulatory compliance requirements.