GRC Analyst

GRC Analyst

The GRC Analyst is a member of the IT Security team and works closely with other IT teams and business stakeholders in the development and automation of core functions supporting the Information Security program. The GRC Analyst will work to support the continued maturity of the GRC program through the development and compliance of IT Security policies and procedures and Security Awareness training. He/she will also support GRC Audit deliverables and respond to client related security inquiries.

What You'll Be Doing

• Support client needs by providing thorough and timely responses to security inquires and questionnaires; participates with onsite and virtual audits and risk remediation.
• Support the GRC program through service delivery of operational activities and related functions to include but not limited to vendor management, security awareness, audit and compliance and exception management.
• Provide input and analysis in the development and deployment of IT Security service deliverables to include but not limited to policy and procedures, risk assessment and control evaluation, security awareness and training, exception management and risk remediation.
• Provide platform administration of GRC related solutions, as required and develop/maintain system documentation supporting usage of third party solutions in the delivery of vendor management, security awareness training and phishing campaigns.
• Provide input and consultation to IT and business resources in the mapping and alignment of Security Policies against prescribed control frameworks, to include but not limited to ISO 27001, ISF Standard of Good Practice for Information Security.
• Maintain dashboards and reporting of respective service deliverables for inclusion in monthly metrics.
• Liase with IT and Business Risk Owners in the management of risk treatment/acceptance plans to include creation, tracking, closure and reporting of compliance status within GRC platform.
• Liase with IT and Business Risk Owners in the management of risk treatment/acceptance plans for related security risks and work within the information security governance process to define control recommendations that are both efficient and effective.
• Participate and contribute to information security working groups and team meetings.
• Maintain documentation of client interactions, risk assessments and IT Security Polices and supporting procedures within document management system.
• Other duties as needed.

Skills We're Seeking

• 3+ years of experience with IT Security and/or relevant IT Governance, Risk and Compliance experience
• Experience with GRC tools, such as RSAM (what we use)
• Experience with ISO 27001

Nice To Haves

• Bachelor's Degree in a relevant field
• CISSP or CISA certifications
• Security Ops, Cyber Security or programming experience
• Technical writing experience