Security Compliance Analyst

Overview

Support the enterprise ISMS and compliance governance program, maintaining control frameworks, evidence quality, audit readiness and reporting across multiple frameworks.

What you'll do

• Support the operation of the enterprise ISMS foundational layer in alignment with Generac's Compliance & Governance operating model.
• Govern enterprise compliance governance activities across ISO 27001, NIST CSF 2.0, NIST 800-171, TX-RAMP, and other applicable frameworks.
• Leverage authoritative outputs from Risk Management, Privacy, and Incident Response to inform governance decisions and prioritization.
• Operate and maintain the common Generac Controls Framework (GCF), including control mappings, applicability logic, and evidence expectations.
• Govern the quality, completeness, and traceability of compliance evidence across all enterprise control owners.
• Maintain authoritative enterprise registers for controls, requirements, evidence, exceptions, corrective actions, and assessments.
• Support readiness assessments for emerging regulatory frameworks impacting connected products and digital systems (e.g., EU Cyber Resilience Act), including control mapping and evidence expectations.
• Facilitate enterprise compliance assessments, readiness reviews, and surveillance activities.
• Coordinate internal and external audit activities and support auditor engagement and evidence validation.
• Ensure enterprise frameworks and evidence expectations support regulated and contractual obligations while execution remains with designated business-unit compliance teams.
• Govern the enterprise exception and corrective action lifecycle, including intake, approval workflows, tracking, and closure assurance.
• Monitor systemic issues, exception trends, and remediation effectiveness across the enterprise.
• Produce enterprise compliance KPIs, dashboards, and management-review inputs.
• Provide governance guidance and communications to control owners to clarify expectations and evidence requirements.
• Contribute to enterprise security and compliance maturity assessments and trend reporting (e.g., NIST CSF 2.0), including baseline establishment and re-assessment support.
• Operate enterprise compliance tooling and workflows.
• Support automation and AI-governance guardrails to improve scale, consistency, and auditability.

What you'll need

• Bachelor's degree (or higher) in Information Security, Cybersecurity, Information Technology, or a related field.
• 4 years of experience in security compliance, GRC operations, ISMS support, or control assurance within an enterprise environment.
• Experience actively supporting, coordinating, or facilitating compliance assessments or audit readiness activities in a governance or assurance capacity across frameworks such as ISO 27001, SOC 2, NIST-based frameworks, or CMMC.
• Experience working within multi-framework compliance programs, including control mapping, evidence governance, and remediation tracking.
• Experience coordinating compliance activities with distributed control owners and stakeholders across multiple business units or regions.
• Strong understanding of security controls, compliance frameworks, and governance practices.
• Familiarity with ISO 27001, NIST CSF, NIST 800-171 / CMMC, TXRAMP, and related regulatory or contractual standards.
• Ability to interpret control requirements and assess the quality, completeness, and traceability of evidence provided by control owners.
• Strong documentation, analysis, and workflow or register management skills supporting auditability and traceability.
• Effective communication skills for working with cross-functional stakeholders across business units and regions.
• Ability to manage multiple concurrent compliance activities and deadlines in a distributed enterprise environment.
• High attention to detail with strong organization and follow-through.
• Ability to work independently and collaboratively within a global team.
• Understanding of cloud environments (AWS, Azure, GCP) and their compliance and shared-responsibility considerations.
• Commitment to integrity, accuracy, and maintaining confidentiality of sensitive enterprise information.

Nice to have

• Foundational certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, or other GRC-related credentials.
• Experience with enterprise compliance tooling, structured registers, or GRC platforms.