Cyber GRC Analyst

About the Role

New Genesis Solutions embeds security leadership directly into our clients' organizations, and GRC is a critical part of how that works. As our GRC Analyst, you will be the day-to-day owner of the governance, risk, and compliance program for a large community health center in Southern California, a multi-site federally qualified health center (FQHC) and HIPAA covered entity. This is not an advisory role where you write recommendations and hand them off. You will run the program: owning the risk register, managing vendor risk, keeping the policy library current, preparing audit evidence, triaging data loss alerts, and reporting to client leadership on a set rhythm. Our model is to build programs the client can eventually run themselves, so part of the job is turning what you do into runbooks that outlast you. The anchor engagement comes first. As capacity allows, you will also support smaller GRC projects across the broader NGS client base, giving you exposure to other industries and frameworks. If you want to grow toward a GRC program lead or compliance manager role, this is a direct path. You're Different

• You follow up without being chased. You know what is open, what is due, and what is slipping before anyone asks.
• When something goes wrong, people hear it from you first, the day you know, along with what you plan to do about it.
• You take pride in building something that keeps working after you move on.
• You look for the root cause, not just the symptom.
• You would rather be part of a strong team than be the hero who rescues every problem.
• You like digging into the details of data and evidence instead of making general assumptions about a system or its environment.
• You use AI tools to work faster, and you can explain and defend every line of your work without them.

We're Different Too

• NGS is evolving from a cybersecurity consulting firm into a Managed Cyber Operations platform, on purpose. We know where we are going and we are building the team to get there.
• We use AI to run a better security operation, not to replace the people running it. Our analysts validate every AI-recommended action. We are the service. The AI is the engine.
• We serve regulated organizations (healthcare, public sector, critical infrastructure) where the stakes of getting security wrong are real. Our clients measure us on outcomes, not activity.
• We believe the problem in cybersecurity is not missing tools. It is missing process, accountability, and follow-through. That is what we fix.

Core Responsibilities Program Operations (Primary Anchor)

• Run the GRC program's operating rhythm: daily checks, the weekly client status call, monthly leadership reporting, quarterly control and access reviews, and annual assessments
• Perform first-line triage of data loss prevention alerts, disposition them the same day, and escalate when needed
• Maintain the client's compliance calendar across HIPAA, California medical privacy law (CMIA), PCI, federal health center program requirements, and county health agency contract audits
• Prepare a one-page monthly metrics report that leads with the decisions leadership needs to make

Risk Management

• Own the enterprise information security risk register: intake, scoring, ownership, treatment tracking, and closure
• Make sure every risk has a traceable source and an owner at manager level or above
• Track pentest, internal assessment, and vulnerability findings through to remediation
• Support the annual HIPAA risk analysis and NIST Cybersecurity Framework (CSF) self-assessment

Vendor and Third-Party Risk

• Run vendor security assessments through a defined three-stage process: risk scenario, vendor questionnaire and follow-up, and a plain-English decision for the business, each with target timelines
• Evaluate vendor security evidence (SOC 2 reports, trust centers, subprocessors), including AI features that send data to outside AI providers
• Make sure Business Associate Agreements are in place before contract signature, and track renewals and reassessments

Policy and Audit

• Manage the policy lifecycle for an existing library of about 30 information security policies, including scheduled reviews and new policy drafts
• Respond to audit and regulator requests: acknowledge the same day, collect evidence, draft responses, and deliver ahead of deadlines
• Collect evidence as work happens, not months later, and keep it organized by control
• Make sure policies and audit responses reflect controls that exist or are formally committed, never aspirational ones

Cross-Client GRC Support (Secondary)

• Support smaller GRC engagements across the NGS client base as capacity allows, mostly project-based work with defined scope and timelines
• Support vCISO deliverables, including executive risk summaries, risk registers, and strategic roadmaps
• Assist with new client onboarding from a GRC and risk posture perspective
• Support SOC 2 readiness assessments as the pipeline develops

Reporting Structure This role reports directly to Andy Jordan, Founder and vCISO of New Genesis Solutions. Day to day, you will work closely with the client's IT and security leadership, privacy officer, and project management office. You will have real autonomy and clear accountability. Direct access to leadership means fast decisions and no red tape, but it also means bringing a recommended solution along with the problem. Requirements - 2+ years of experience in a GRC, compliance, or information security role - Working knowledge of the HIPAA Security and Privacy Rules - Hands-on experience with NIST CSF assessments or similar risk frameworks - Experience maintaining a risk register, including scoring, ownership, and closing items - Experience conducting vendor risk assessments and managing third-party risk processes - Experience with audit response: collecting evidence, drafting responses, and coordinating with stakeholders - Strong plain-English writing for policies, audit responses, and executive reports - A track record of running recurring work on a schedule without reminders - Detail-oriented, with strong organizational and tracking skills - Ability to work independently across multiple workstreams - Must reside in the Western United States (Pacific, Mountain, or Arizona time zone) Nice to Have - Experience in healthcare, especially FQHCs, hospitals, or health plans, or in state and local government - Familiarity with California medical privacy law (CMIA) or county and state health agency audits - Experience with data loss prevention tools or alert triage (for example, Microsoft Purview or Varonis) - Experience assessing AI-enabled vendors or familiarity with ISO/IEC 42001 - Familiarity with SOC 2 Trust Services Criteria and readiness assessments - Relevant certifications: CISA, CRISC, CISSP, HCISPP, or CompTIA Security+ Benefits - Competitive salary based on experience and qualifications - Health, dental, and vision insurance - Paid time off and holidays - Professional development opportunities and certification support - Annual profit sharing program - Pathway to ownership within NGS Background Investigation Employment is contingent upon the results of a comprehensive background investigation including work experience verification, criminal background, and a personal credit history review.

Company Description

New Genesis Solutions was founded in 2018 by Andy Jordan, a practicing vCISO with deep experience in regulated industries. What started as a vulnerability management and advisory firm has evolved into a Managed Cyber Operations platform — and we're in the middle of that evolution right now. We serve healthcare organizations, public sector agencies, and critical infrastructure clients who need security programs that actually work — not just tools that generate dashboards. Our clients rely on us as an extension of their security leadership, not a vendor they manage. What We Do

• Managed Security Operations (MDR/SOC): 24/7 detection, validation, and response powered by AI and staffed by human analysts — we wake up at 3am so clients don't have to
• Co-Managed SIEM: Microsoft Sentinel and Splunk management, tuning, and optimization as a shared responsibility with client teams
• Identity Security Operations: Entra ID, conditional access, privileged account management, and IAM program buildout
• Attack Surface Management (ASM): Continuous external exposure monitoring and prioritized remediation guidance
• vCISO & Governance: Fractional security leadership embedded in client organizations, including policy, compliance program management, and board reporting
• GRC & Compliance: NIST-CSF assessments, HIPAA compliance, regulatory audit response, vendor risk management, and SOC 2 readiness
• Offensive Security: Penetration testing, red teaming, and security assessments for regulated-industry environments

Where We're Headed NGS is on a deliberate path from a founder-led consulting firm to a scalable Managed Cyber Operations platform. We're building the team, the systems, and the service architecture to support that growth — targeting $10M in annual revenue over the next several years. The people who join us now are joining at a moment when the work they do will directly shape what this company becomes. Our Operating Principles

• People, process, technology — in that order. Most security failures aren't tool failures. We fix the process and accountability layer first.
• Outcomes over activity. Our clients don't pay for hours or reports — they pay for a security program that matures year over year.
• AI amplifies maturity — or immaturity. We use AI tooling because it makes us better, and we validate every AI action because being better requires judgment, not just speed.
• Accountability without bureaucracy. We're a small, senior team. Everyone owns their results. There's no committee between a problem and a decision.