Senior GRC Analyst

Responsibilities

Governance

• Develop, review, and maintain security policies, standards, and procedures, ensuring they remain current and aligned with business needs
• Manage the policy exception tracking process, including intake, review, and escalation
• Coordinate policy acknowledgment and sign-off across business units
• Support and help improve the organization's security awareness training program
• Prepare governance metrics and reporting for leadership and board-level stakeholders

Risk Management

• Own and maintain the enterprise risk register, ensuring risks are accurately documented, scored, and tracked
• Conduct risk assessments for new projects, systems, and vendors, as well as periodic reviews of existing risks
• Facilitate risk scoring and prioritization sessions with business and technical stakeholders
• Track risk treatment plans and follow up with owners to ensure timely remediation
• Manage the third-party vendor risk assessment program, including questionnaires and ongoing monitoring
• Support business impact analysis (BIA) and business continuity planning efforts

Compliance

• Map and maintain control libraries aligned to frameworks such as NIST CSF, ISO 27001, SOC 2, GDPR
• Coordinate internal and external audit engagements, including evidence collection and stakeholder communication
• Perform control testing and gap assessments, documenting findings and recommending remediation
• Track open audit findings through to closure
• Monitor regulatory and framework changes, assess organizational impact, and recommend updates
• Support data privacy compliance activities related to GDPR, CCPA, or other applicable regulations

Day-to-Day Operations

• Own and administer the GRC platform (e.g., Archer, Vanta, Drata, ServiceNow GRC), driving adoption and continuous improvement
• Lead responses to complex customer security questionnaires, RFPs, and due diligence requests
• Serve as the compliance lead for incident response activities, ensuring documentation, notification obligations, and regulatory requirements are met
• Act as the primary GRC point of contact for IT, Legal, HR, Finance, and business unit teams — driving control ownership and accountability across the organization

Qualifications

• Bachelor's degree in Information Security, Computer Science, Business, or a related field (or equivalent experience)
• 3-5 years of experience in GRC, IT audit, information security, or a closely related role
• Working knowledge of at least two major compliance frameworks (NIST CSF, ISO 27001, SOC 2, HIPAA, PCI-DSS, etc.)
• Experience collecting audit evidence and managing audit engagements
• Familiarity with GRC tools and platforms
• Strong written communication skills — able to translate technical risk concepts for non-technical audiences
• Highly organized with the ability to manage multiple workstreams and deadlines simultaneously

Nice to Have

• Relevant certifications: CompTIA Security+, CISA, ComptIA CC, CRISC, CGEIT, or CCSP
• Experience with cloud environments (AWS, Azure, GCP) and cloud security frameworks
• Exposure to data privacy regulations (GDPR, CCPA)
• Experience responding to customer security questionnaires
• Experience with AI laws and regulations