Information Security GRC Analyst
Core
Support the integrity and safety of information by driving excellence in Governance, Risk and Compliance programs, collaborating across departments to implement best practices and maintain cybersecurity standards.
Role type
Information Security GRC Analyst
Builds
Enterprise information security policies, risk management processes, and compliance frameworks aligned with ISO 27001/27002 and NIST 800-53.
Domain
Information Security / Governance, Risk and Compliance
Required skills
Risk assessment and mitigation, Policy development and enforcement, Third-party risk management, Compliance validation, Metrics tracking and reporting, Framework alignment (ISO/NIST)
Preferred skills
Bachelor's degree in Security/CS/MIS/IT, 3+ years in IT security or GRC, Familiarity with ISO 27001/27002 or NIST 800-53
Technologies
ISO 27001, NIST 800-53
Responsibilities
Support third-party risk management by collecting and reviewing risk artifacts; Develop and implement policies, standards, and procedures; Maintain and enforce enterprise information security policies; Create, track, and report on GRC program metrics; Conduct risk assessments, assign rankings, and oversee treatment plans; Validate control compliance; Manage cybersecurity risk exceptions and waivers; Serve as liaison for internal and external audit engagements.
Seniority
Associate, hands-on IC