GRC Associate
Core
Security GRC Associate responsible for managing third-party security risk and assurance, supporting ISO 27001 compliance, and improving GRC processes using automation and AI.
Role type
Associate-level Information Security GRC professional
Builds
Third-party risk management framework, supplier assurance programs, and automated GRC tooling
Domain
Cybersecurity, Third-Party Risk Management, Governance, Risk, and Compliance (GRC)
Required skills
Third-party security risk assessment, Supplier assurance documentation review, Security standards knowledge (ISO 27001, NIST CSF), Stakeholder management, Risk documentation and remediation tracking, GRC framework improvement
Preferred skills
GRC platform experience (ServiceNow, Archer, LogicGate), ISO 27001 audit support, Cloud/SaaS security assessment, AI governance frameworks, Process automation, AI tools usage
Technologies
ISO 27001, NIST CSF, SOC 2, ServiceNow GRC, Archer, LogicGate, Vanta, Compyl, ISO/IEC 42001, NIST AI RMF
Responsibilities
Run third-party security risk assessments for suppliers and partners, Review supplier assurance evidence (certificates, reports, questionnaires), Identify and document third-party security risks, Assess security risks of AI tools and integrations, Partner with Procurement and Legal to build security requirements into onboarding, Maintain third-party risk records and track remediation, Shape risk-based approach to ongoing supplier assurance, Improve GRC tooling using automation and AI, Support ISO 27001 assurance work and internal control framework maintenance
Seniority
Associate, hands-on IC
