Information Security GRC Analyst
Core
Develop, review, and maintain security policies, procedures, and standards aligned with regulatory and industry frameworks; lead or support responses to audits and compliance assessments.
Role type
mid-level IC information security GRC analyst
Builds
security policies, audit evidence packages, risk reports, and staff security-awareness training
Domain
Information Security / Governance, Risk, and Compliance (GRC)
Required skills
policy writing, audit support, risk assessment, control gap analysis, regulatory framework knowledge (NIST, ISO, SOC 2, HIPAA, PCI-DSS, GDPR), stakeholder coordination, security scan coordination, CI/CD pipeline review, secrets management
Preferred skills
CISSP, CISA, CISM, ISO 27001 Lead Implementer, Security+, OWASP Top 10, API security (OAuth2, OpenID Connect), container security, application-layer threats, CI/CD pipeline security
Technologies
API, CI/CD, OWASP, OpenID, Security, AWS, Azure, Cloud, DevOps, GitHub, Jenkins
Responsibilities
Develop and maintain security policies aligned with frameworks; support third-party and internal audits; gather evidence for compliance assessments; support risk assessments and track remediation; deliver security-awareness training; coordinate security scans and review findings; review CI/CD configurations for compliance.
Seniority
Mid-level, hands-on IC