IT GRC Analyst
Core
Develop, implement, and manage the IT risk and compliance program, including ITGC, SOX 404, and alignment to NIST CSF, ISO 27001, and COBIT.
Role type
Mid-level IT GRC Analyst
Builds
IT risk and compliance program, cyber risk register, audit-ready evidence
Domain
IT Governance, Risk, and Compliance (GRC)
Required skills
SOX 404 compliance, ITGC testing, third-party risk assessment, GRC frameworks (COBIT, COSO, NIST CSF, ISO 27001), data privacy regulations (GDPR, CCPA, DPDP Act), audit coordination, control testing, policy lifecycle management
Preferred skills
CISA, CRISC, CGEIT certifications, GRC tooling experience, cross-functional communication
Technologies
NIST CSF, ISO 27001, COBIT, COSO, SOC 2, GDPR, CCPA, DPDP Act, NIS2, SACS-210
Responsibilities
Facilitate cybersecurity risk assessments and maintain the cyber risk register; Lead SOX IT compliance activities including audit evidence collection and control testing; Coordinate third-party cybersecurity risk assessments and vendor security reviews; Maintain IT GRC documentation including control narratives and risk-and-control matrices; Partner with Internal Audit and external auditors to support audit cycles; Support customer security questionnaires and regulatory assessments.
Seniority
Mid-level, hands-on IC
