Governance, Risk, and Compliance (GRC) Analyst

Job title: Governance, Risk, and Compliance (GRC) Analyst

About the Role

Tyler Technologies is seeking a Governance, Risk, and Compliance (GRC) Analyst to support the Data & Insights (D&I) solutions within the Security team. The role focuses on sustaining and strengthening the FedRAMP Moderate ATO for the D&I cloud platform, driving audit readiness, continuous monitoring, and regulatory compliance. You will coordinate with Security, Engineering, Legal, Privacy, and external assessors to deliver secure, compliant cloud services and act as the central driver of the compliance program.

What You'll Do

• Own FedRAMP Moderate authorization sustainment and audit readiness.

• Manage ConMon, POA&Ms, annual assessments, evidence quality, and overall ATO health.

• Lead readiness for evolving FedRAMP standards, including FedRAMP 20x, and track program changes.

• Serve as primary compliance program coordinator for the D&I Security team; partner with Security, TIRE, Legal, Privacy, and external assessors.

• Own FedRAMP change management and authorization boundary governance; manage SIAs, SCRs/SCNs, authorization boundary docs, AO communications.

• Support risk-based decision-making; document control exceptions, risk acceptances, compensating controls per FedRAMP.

• Coordinate external assurance activities (SOC 2 Type II); manage auditor engagement and evidence collection; align with FedRAMP/NIST controls.

• Maintain system-of-record for compliance docs; own SSP, ConMon plan, control narratives, diagrams, appendices for accuracy and traceability.

• Drive multi-framework alignment across FedRAMP, CJIS, HIPAA, GDPR; plan internal assessments.

• Manage annual OWASP SAMM re-assessments, periodic Cloud Security Assessments (AWS Well-Architected), CJIS audits; measure maturity and prevent drift.

• Support D&I cloud security and Tyler's security maturity initiatives; align assessments with governance goals.

• Continuously improve compliance processes and move toward automation; reduce manual effort and improve evidence quality.

• What We're Looking For

• Strong organization and prioritization skills; ability to manage ConMon, POA&Ms, evidence collection, change tracking, and audit deliverables across overlapping timelines.

• Clear, accurate written and verbal communication; ability to document controls and explain compliance requirements, risks, and decisions to engineers, auditors, customers, and non-technical stakeholders.

• Collaborative, cross-functional working style; comfortable partnering with Security, Engineering, Infrastructure & Release (TIRE), Legal, Privacy, and external assessors.

• Detail-oriented with a systems-level perspective; track control requirements, dependencies, and boundary impacts while understanding how updates affect overall authorization health.

• Reliability and accountability; consistently follows through, maintains accurate records, meets deadlines, and communicates status, risks, or blockers early.

• Comfort working within structured frameworks and deadlines; operate effectively within FedRAMP, NIST, SOC 2, and similar frameworks.

• Practical problem-solving mindset; identify gaps, inconsistencies, or risks and resolve them pragmatically.

• Proactive learning and openness to feedback; willingness to build expertise in FedRAMP, NIST, CJIS, HIPAA, GDPR, and regulatory requirements over time.

• Adaptability and resilience; adjust to changing regulatory guidance, audit findings, and shifting priorities while maintaining quality.

• Stakeholder- and trust-focused mindset; appreciate how strong compliance practices support customer trust and audit confidence.

• Tools and Technologies: FedRAMP Moderate tooling, including SSPs, control narratives, ConMon deliverables, POA&Ms, SARs, and other annual assessment artifacts.