GRC Analyst

Position Summary:

The GRC Analyst supports the operation and continued maturity of the organization's Information Security Governance, Risk, and Compliance (GRC) program. This role is responsible for executing assigned GRC activities including control management, risk and issue tracking, audit readiness, policy governance, third party risk assessments, compliance evidence management, business continuity support, and reporting. The analyst will help maintain a unified control environment across healthcare regulatory requirements and industry security frameworks and will work closely with Information Security, Information Technology, Compliance, Legal, Internal Audit, and business stakeholders. Job Profile Summary: The GRC Analyst supports Information Security Governance, Risk, and Compliance activities in alignment with organizational policies, regulatory requirements, and industry best practices. This role helps maintain a unified control environment across multiple security and privacy frameworks and provides documentation and control support during audits and assessments. Responsibilities: Information Security Governance Support the maintenance and operation of the Information Security Management System (ISMS) and unified control framework, including mapping common controls across NIST CSF, HIPAA/HITECH, HITRUST, SOC 2, ISO 27001, SOX/ITGC, and other applicable requirements Support the development, review, approval, and maintenance of Information Security policies, standards, and procedures Partner with control owners to document controls, establish evidence requirements, assess control performance, identify gaps, and coordinate remediation activities Perform or support control assessments and testing to evaluate control design and operating effectiveness, document deficiencies, and track remediation through closure Maintain GRC platform records, workflows, control mappings, evidence repositories, risk registers, dashboards, and reporting, and identify opportunities to automate recurring compliance activities Policy, Exception & Compliance Governance Maintain the Information Security policy lifecycle, including review schedules, stakeholder coordination, approvals, version control, and periodic updates based on regulatory, framework, and organizational changes Administer the security exception and risk acceptance process, including intake, documentation, risk assessment, approvals, expiration dates, compensating controls, and periodic review Support the integration of compliance and control requirements into operational workflows, projects, technology implementations, and ongoing business processes Metrics, Reporting & Leadership Engagement Develop and maintain recurring GRC reporting for leadership, including control effectiveness, audit and assessment status, remediation progress, policy compliance, third-party risk, and key information security risks Maintain and report key performance and risk indicators (KPIs/KRIs) across GRC, audit, risk management, third-party risk, and BCDR activities Translate technical risk, control, and compliance information into concise, business-relevant insights for leadership and non-technical stakeholders

Audit Support Assist with documentation and control evidence gathering to support SOC 2, HITRUST, HIPAA, and other healthcare security-related audits Support SOC 2 Type II and HITRUST audit readiness activities, contributing to continuous compliance efforts rather than point-in-time preparation At the direction of leadership, partner with internal and external auditors to support audits, assessments, and remediation efforts Risk Management Maintain assigned information security risks within the enterprise risk register, including risk statements, inherent and residual risk ratings, mitigating controls, treatment plans, ownership, and review dates Support risk assessments and issue management activities related to technology initiatives, security findings, control deficiencies, operational changes, and other information security-related activities Coordinate with risk and control owners to document remediation plans, establish target dates, monitor progress, and escalate overdue or material risks Support formal risk acceptance activities and ensure accepted risks are documented, approved, time-bound, and periodically reassessed Business Continuity & Disaster Recovery (BCDR) Support the Business Continuity and Disaster Recovery program, including Business Impact Analyses (BIAs), business continuity plans, disaster recovery documentation, RTO/RPO validation, exercise coordination, remediation tracking, and annual reporting Coordinate with business and technology owners to maintain current business continuity and disaster recovery documentation and track gaps identified through exercises, testing, or assessments Third-Party Risk Management (TPRM) Support the operation of the third-party risk management program in coordination with Procurement, Legal, Compliance, Information Security, and business stakeholders. Support vendor risk assessments, including vendor tiering, security questionnaires, risk analysis, and documentation of identified gaps. Review vendor assurance documentation such as SOC reports, HITRUST certifications, ISO certifications, penetration testing summaries, security policies, and other supporting artifacts. Leverage independent assurance reports and certifications to reduce unnecessary assessment duplication where appropriate. Track third-party risks, remediation items, exceptions, and ongoing monitoring activities through closure Support incorporation of third-party risk information into enterprise and information security risk reporting Knowledge, Skills, and Abilities: Strong communication skills, including oral communication, report writing, and presentation skills Strong analytical, problem-solving, and critical-thinking skills Strong organizational and project coordination skills with the ability to manage multiple concurrent audits, assessments, remediation items, and deadlines Strong attention to detail and commitment to documentation quality and accuracy Ability to promote the value of governance, risk, and compliance among internal and external stakeholders Ability to interpret regulatory, contractual, and security framework requirements and translate them into practical and scalable controls Ability to collaborate effectively with technical teams, business stakeholders, auditors, Legal, Compliance, and executive leadership Ability to stay current with regulatory changes, evolving security frameworks, and industry standards Ability to promote practical, risk-based governance while maintaining a customer-service mindset Security & Compliance Frameworks: General understanding of ISO 27001, NIST CSF, HITRUST, SOC 2 Type II, HIPAA, and SOX Audit & Compliance:

Experience supporting audits and continuous compliance programs BCDR & Resilience:

Familiarity with business continuity planning, disaster recovery, Business Impact Analysis (BIA), RTO/RPO concepts, and resilience testing Third-Party Risk:

Understanding of vendor risk assessment, due diligence, and ongoing monitoring practices Policy & Control Design:

Ability to support the design of scalable, practical, and enforceable controls Communication:

Strong written and verbal communication skills to support collaboration with internal and external partners Education (Required and/or preferred): Associate or bachelor's degree in MIS, Computer Science, or related discipline with appropriate exposure to information security concepts, processes, and systems is required GRC-related training and/or certifications is preferred Field Of Study: Information Technology/Information Security/Compliance Work Experience/Qualifications: 1-4 years of experience in Information Technology, Compliance, Risk Management, or related function Experience supporting GRC, risk, or compliance activities is preferred Direct exposure to HIPAA, ISO 27001, HITRUST, NIST, or SOC 2 frameworks is a plus