Lead Governance, Risk, and Compliance (GRC) Analyst

Lead Governance, Risk, and Compliance (GRC) Analyst

Req ID : 5706

Position Type : Information Technology

Job Overview

At MoFo, we couldn't write our own success story without yours. Ready to write your story?

Join MoFo as a LEAD GRC ANALYST on our Information Technology team!

This role can be based in San Francisco, Palo Alto, Los Angeles, San Diego, Denver, Austin, Boston, New York or Washington, D.C. https : / / www.mofo.com / offices

ABOUT THE ROLE

The Lead Governance, Risk, and Compliance (GRC) Analyst is responsible for managing the firm’s information security governance, risk, and compliance program. This role serves as the operational lead for maintaining ISO 27001 certification, managing client and vendor audits, overseeing policy governance, and ensuring continuous audit readiness across all systems and jurisdictions. The ideal candidate will be a subject matter expert in information security controls and audit practices, with deep experience in ISO 27001, NIST, and related frameworks. This position requires strong leadership, collaboration, and communication skills, along with the ability to engage effectively with senior leadership, clients, and external auditors.

Governance, Risk & Compliance

• Lead and manage the firm’s Information Security Management System (ISMS) to maintain ISO 27001 certification and ongoing compliance.
• Develop, implement, and monitor controls aligned with ISO 27001, NIST 800-53, DOJ, and CISA EO 14117 frameworks.
• Serve as the primary liaison for internal, external, client, and vendor security audits, including documentation, evidence, and remediation tracking.
• Manage the firm’s compliance calendar and ensure timely completion of assessments, certifications, and audits.
• Improve compliance processes through automation, standardized evidence tracking, and enhanced reporting.
• Oversee the governance and maintenance of security and privacy policies to ensure alignment with frameworks and regulatory requirements.
• Conduct risk assessments and document mitigation strategies.
• Collaborate with IT, Legal, Privacy, and business units to ensure consistent control implementation and reporting.
• Track and report key performance metrics to measure compliance posture and program maturity.

Audit and Compliance Leadership

Policy and Documentation Management

Program Maturity and Process Improvement

Client Service and Confidentiality

Ensure timely and professional communication during client and vendor audit engagements.

ABOUT YOU

Core Competencies and Applied Skills

ABOUT MOFO

At MoFo, we collaborate as one firm, across borders, practice areas, and business functions and value fresh ideas and innovation over conformity and competition.

ABOUT OUR BENEFITS

MoFo offers a comprehensive benefits package starting on your first day.

Where required by law, salary ranges are stated below. Additional compensation may include a discretionary bonus, overtime as applicable, health / welfare benefits, retirement contributions, paid holidays, and PTO. The range displayed is specifically for positions performed in those cities / state and may vary based on factors including but not limited to the following : local market data and ranges; an applicant’s skills and prior relevant experience; and certain degrees, licensing, and certifications. The application deadline is May 13, 2026.

New York, San Francisco, Palo Alto salary range : $128k to $178k

Los Angeles, San Diego, Boston, Washington, D.C. salary range : $122k to $169k

Denver salary range : $114k to $159k

For questions regarding this position, please e‑mail jobs@mofo.com

Morrison & Foerster is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, sex, religion, creed, ethnic or national origin, ancestry, age, disability, veteran or military status, marital status, pregnancy, sexual orientation, gender identity, domestic partner status, and other categories protected by applicable laws, or in retaliation for opposition to any practices forbidden under this policy.

PI279783156

#J-18808-Ljbffr