Atmosera - GRC Analyst (Remote

• Cloud Governance & Compliance Operations • Validate that client environments meet MGRC baselines and support ongoing security policy alignment to: • Microsoft Cloud Security Benchmark (MCSB) • NIST frameworks (NIST SP 800-171, NIST SP 800-53, etc.) • HIPAA (where applicable) • Assist with governance documentation updates and maintenance • Support compliance tracking and evidence organization • Provide consultative guidance on compliance and security-related questions by coordinating access to Atmosera cybersecurity experts • Monitor security posture through Defender for Cloud and Azure Policy compliance recommendations • Track misconfigurations, policy drifts, and high impact findings for remediation. • Security Questionnaires • Assist with basic security questionnaires using Atmosera’s standard response library • Provide standardized responses through coordination with the Account Management or Client Success team • Support optional full Security Questionnaire Management services when contracted, including: • Intake and tracking • Drafting and coordination of responses • Supporting documentation preparation • Audit & Assurance Support • Participate directly in client audits (SOC 2, HIPAA, PCI where applicable) • Support ongoing audit readiness and management activities when included in scope, including: • Evidence gathering and organization • Audit request tracking • Coordination with internal teams and external auditors • Ensure ongoing audit readiness for clients enrolled in MGRC that is consistent with MGRC service definitions in shared documentation • Maintain audit readiness documentation throughout the year • Maintain audit request trackers and coordinate responses with internal SMEs. • Support project management activities related to compliance audits (e.g., SOC 2) • Security Operations Governance Support • Ensure proper documentation to support compliance with client governance requirements and client specific requirements • Take ownership of monthly and quarterly MGRC reporting • Assist with the development and maintenance of custom response playbooks for: • Azure Sentinel SOAR (Security Orchestration, Automation, and Response) • Support governance oversight of: • CyberSOC reporting with enhanced security insights • Actionable threat intelligence reporting • Proactive threat hunting outputs • Ensure governance artifacts align with managed detection and response activities • Security Readiness & Preparedness Activities • Coordinate and support: • Monthly phishing simulation preparedness activities • Yearly tabletop exercise planning and execution support • Bi-annual penetration testing preparedness and coordination • Track outcomes, findings, and remediation activities for readiness exercises • Attack Surface & Security Posture Management • Support Attack Surface Management activities, including: • Continuous discovery and monitoring of exposed assets • Documentation of digital attack surface insights • Assist with security posture tracking and compliance reporting for: • Internal stakeholders • Monthly Server vulnerability Scanning • Design and implement workflows that improve the service • Track findings, prepare client-facing reports, and coordinate remediation with security engineers • Penetration Test Coordination • Serve as the primary coordinator for client penetration testing engagements • Manage scheduling, scope alignment, retesting cycles, evidence handoff and management of the relationship with penetration testing teams. • Maintain communication and set expectations with organizations being tested • Cloud Governance Support • Support Azure Policy implementation and monitoring using advanced governance features • Assist with ensuring Azure resources and configurations remain compliant with defined security baselines • Track and report service misconfigurations, compliance drift and remediation status • Monitor security posture through Defender for Cloud and Azure Policy compliance results • Validate that client environments meet MGRC baselines. Microsoft Cloud Security Benchmarks, and any additional client-specific compliance requirements supported by Azure • Collaboration & Service Delivery • Work closely with: • Client Success Managers • Security Analysts and Engineers • Account Management representatives • Escalate issues, risks, or scope concerns to appropriate senior resources • Operate within defined MGRC service boundaries and SLAs • Purview Compliance Manager Administration • Track regulatory control posture, improvement actions, and evidence assignments. • Guide clients through remediation and maintain year-round compliance readiness. • Partner with engineering teams on policy and control mappings (Azure Policy, Defender for Cloud) that support compliance scoring as discussed in internal service map documentation.