GRC Analyst

GRC Analyst

Apply Online

Tyler Technologies is seeking a Governance, Risk, and Compliance (GRC) Analyst to support our Data & Insights (D&I) solutions within the Security team. This role offers a meaningful opportunity to own and evolve the compliance posture of Tyler's D&I cloud platform, with a primary focus on sustaining and strengthening our FedRAMP Moderate Authorization to Operate (ATO) in an evolving regulatory landscape.

In this role, you will serve as a central driver of audit readiness, continuous monitoring, and compliance program execution-partnering closely with Security, Engineering, Infrastructure & Release (TIRE), Legal, Privacy, and external assessors. You will operate in a fast-paced, results-driven environment where strong coordination, documentation quality, and risk-informed decision-making are essential to delivering secure, compliant, and resilient cloud services.

The D&I team serves as Tyler Technologies' central hub for data, reporting, analytics, and artificial intelligence capabilities. Our teams build and maintain the foundational services and solutions that enable data-driven innovation across Tyler's product portfolio. We empower teams throughout the organization to incorporate advanced analytics, AI, and data-driven features into their products, ultimately helping government agencies make better decisions and serve their communities more effectively. Team members contribute their expertise to reduce complexity, introduce innovative solutions, and advance Tyler's data-driven future.

Location

Seattle, Washington | Remote

Responsibilities

• Own FedRAMP Moderate authorization sustainment and audit readiness. Managing continuous monitoring (ConMon), POA&Ms, annual assessments, evidence quality, and overall ATO health.
• Lead readiness for evolving FedRAMP standards, including FedRAMP 20x. Tracking program changes, identifying compliance gaps, and coordinating documentation and process updates.
• Serve as the primary compliance program coordinator for the D&I Security team. Partnering across Security, Engineering, Infrastructure & Release (TIRE), Legal, Corporate Security and Privacy, and external assessors to deliver consistent, audit-ready outcomes.
• Own FedRAMP change management and authorization boundary governance. Managing Security Impact Analyses (SIAs), Significant Change Requests and Notifications (SCRs/SCNs), authorization boundary documentation, and federal / Authorizing Official (AO) communications.
• Support risk-based decision-making. Documentation of control exceptions, risk acceptances, and compensating controls in alignment with FedRAMP and organizational governance.
• Coordinate external assurance activities, including SOC 2 Type II assessments. Managing auditor engagement, evidence collection, findings tracking, and alignment with existing FedRAMP/NIST controls.
• Maintain the system-of-record for compliance documentation and artifacts. Owning the System Security Plan (SSP), ConMon plan, control narratives, diagrams, and appendices to ensure accuracy, traceability, and defensibility.
• Drive multi-framework compliance alignment across regulated environments. Supporting FedRAMP, CJIS, HIPAA, and GDPR through gap identification, baseline documentation, and evidence reuse.
• Plan and execute internal compliance assessments. Managing annual OWASP SAMM re-assessments, periodic Cloud Security Assessments (AWS Well-Architected), and internal CJIS audits to measure maturity and prevent compliance drift.
• Support D&I's cloud security and Tyler's security maturity initiatives. Managing applicable assessments and re-assessments, and aligning outcomes with broader security and compliance goals.
• Continuously improve compliance processes and maturity. Reducing manual effort, improving evidence quality, and preparing the organization for increased automation and reporting expectations.

Qualifications

Soft Skills

• Strong organization and prioritization skills. Ability to manage continuous monitoring, POA&Ms, evidence collection, change tracking, and audit deliverables across overlapping timelines without losing accuracy.
• Clear, accurate written and verbal communication. Ability to document controls and evidence clearly and explain compliance requirements, risks, and decisions to engineers, auditors, customers, and non-technical stakeholders.
• Collaborative, cross-functional working style. Comfort partnering with Security, Engineering, Infrastructure, Legal, Privacy, and external assessors to drive consistent, audit-ready outcomes.
• Detail-oriented with a systems-level perspective. Ability to track control requirements, dependencies, and boundary impacts while understanding how individual updates affect overall authorization health.
• Reliability and accountability. Consistently follows through on assigned work, maintains accurate records, meets deadlines, and communicates status, risks, or blockers early.
• Comfort working within structured frameworks and deadlines. Ability to operate effectively within FedRAMP, NIST, SOC 2, and similar frameworks, including audits, assessments, and recurring reporting cycles.
• Practical problem-solving mindset. Able to identify gaps, inconsistencies, or risks in documentation or processes and work with others to resolve them pragmatically.
• Proactive learning and openness to feedback. Willingness to build expertise in FedRAMP, NIST, CJIS, HIPAA, GDPR, and regulatory requirements over time and incorporate feedback into work.
• Adaptability and resilience. Ability to adjust to changing regulatory guidance, audit findings, and shifting priorities while maintaining quality and professionalism.
• Stakeholder- and trust-focused mindset. Appreciation for how strong compliance practices support customer trust, audit confidence, and long-term platform credibility.

Tools and Technologies