Sr. Information Security GRC Analyst

Our client is seeking a Senior Information Security GRC Analyst to support and advance their Information Security Governance, Risk, and Compliance (GRC) program. In this role, the selected candidate will assess and strengthen IT and security controls across the organization while ensuring alignment with regulatory, statutory, and industry security standards including ISO/IEC 27001:2022, PCI DSS, and internal security policies.

This South Bend, IN-based position works closely with IT teams, business leaders, and audit stakeholders to identify risk exposures, strengthen control frameworks, support audit readiness, and drive continuous improvement in the company's overall security posture. The position requires a strong mix of technical understanding, risk assessment expertise, and the ability to translate compliance requirements into practical, business-aligned security controls. The organization operates under core values focused on Integrity, Our People, Our Customers, Growth, and Attitude.

Position Key Responsibilities

• Governance, Risk & Compliance Leadership: Advise IT and business stakeholders on GRC requirements by interpreting regulatory, statutory, and security standards into actionable control recommendations. Lead and support the information security risk management program, including risk identification, assessment, documentation, and mitigation monitoring.
• Controls & Compliance: Develop and maintain GRC program documentation (security policies, standards, risk registers, control inventories, evidence repositories). Strengthen internal security controls by improving standardization and compliance alignment while defining control expectations and audit evidence requirements across teams.
• Audit & Testing: Coordinate internal and external audits from planning through remediation tracking. Execute security control testing by defining scope, reviewing and validating evidence, documenting results, identifying deficiencies, and managing corrective actions and risk acceptance documentation.
• Program Improvement: Support security initiatives and technology projects by embedding GRC practices into delivery. Track program metrics, audit results, and compliance trends to improve security maturity, providing recommendations to strengthen the overall security and compliance framework.

Candidate Qualifications & Requirements

• Experience: 5-7 years of experience in IT, cybersecurity, risk management, audit, or compliance roles.
• Technical & Framework Knowledge: Strong knowledge of information security frameworks (ISO/IEC 27001, PCI DSS) and familiarity with GDPR concepts. Solid understanding of IT environments, systems, and security controls across infrastructure, applications, and data environments.
• Education: Bachelor's Degree in Information Systems, Information Technology, Cybersecurity, Risk Management, or a related field.
• Skills: Demonstrated analytical capabilities to evaluate control design and operational effectiveness, strong organizational and documentation skills, and clear communication abilities to translate complex concepts to technical and non-technical audiences.
• Certifications: Must possess (or be able to obtain within a reasonable timeframe post-hire) one or more of the following credentials: CISA, CRISC, CISSP, CISM, CompTIA Security+, or an equivalent professional risk/audit certification.

#ben #infotech