Senior GRC Analyst – Cybersecurity Governance & Risk

About the role

As a Senior GRC Analyst for Oceaneering, you will support the organization’s cybersecurity governance, risk management, compliance, and security‑assurance programs. You will partner with business units, IT, OT, legal and regulatory stakeholders to implement security controls, maintain compliance with industry and government requirements, reduce cyber risk and protect critical information assets. The role offers a hybrid work environment, combining virtual work with on‑site presence in Houston when required.

Key responsibilities

• Develop, maintain and enhance cybersecurity policies, standards, procedures and governance frameworks.
• Conduct cybersecurity risk assessments and coordinate mitigation activities.
• Support compliance initiatives such as NIST, CMMC, Cyber Essentials, ISO, FedRAMP and UK government requirements.
• Lead responses to customer, supplier and regulatory cybersecurity questionnaires and audits.
• Review system architectures, cloud solutions and OT environments for security and compliance impacts.
• Coordinate vulnerability management, corrective‑action tracking and remediation activities.
• Support incident response, investigations and security event escalation processes.
• Manage cybersecurity documentation, evidence collection and audit‑readiness activities.

Required profile

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science or related field (or equivalent experience).
• Minimum 5 years of experience in cybersecurity, risk management, compliance, governance or information security.
• At least 5 years working with NIST SP 800‑53, NIST SP 800‑171 and the Risk Management Framework.
• Minimum 5 years conducting security assessments, audits and control implementation.
• At least 3 years of experience in cloud security, identity management, endpoint protection, vulnerability management and security monitoring.
• U.S. citizen or permanent resident (ITAR compliance required).

Required skills

• NIST SP 800‑53 and NIST SP 800‑171
• Risk Management Framework (RMF)
• Cloud security and governance platforms
• Identity management and access control (e.g., Entra ID)
• Endpoint protection and vulnerability management
• Security monitoring and incident response
• Security assessments and audit coordination
• Technical writing and documentation
• Microsoft 365 security, Microsoft Purview, Microsoft Defender