GRC Cybersecurity Analyst

Job Description

***We are unable to sponsor as this is a permanent full-time role***

***Hybrid, 3 days onsite, 2 days remote***

Responsibilities:

\n
• Lead responses to client security assessments, questionnaires, and audits, documenting evidence and performing risk assessments as needed.
\n
• Create, maintain, and evolve security policies, standards, guidelines, and supporting documentation through strong technical writing.
\n
• Manage and support processes that ensure Information Technology (IT) systems meet cybersecurity, risk, and compliance requirements.
\n
• Serve as an Information Security subject matter expert, advising technical and non-technical stakeholders across the organization.
\n
• Manage the third-party Security Vendor Risk Management program, including assessments, remediation tracking, and lifecycle oversight.
\n
• Oversee the security exception request process and provide guidance on appropriate risk treatment decisions.
\n
• Manage the full lifecycle of the Security Awareness program, including roadmap development, training evaluation, and effectiveness measurement.
\n
• Support and optimize Governance, Risk, and Compliance (GRC) technology platforms and associated workflows.
\n
• Conduct evaluations of IT programs and components to confirm alignment with published security standards and frameworks.
\n

Qualifications:

\n
• Bachelor's degree or equivalent with five (5) years of work experience in IT Security is required.
\n
• Certified Information Systems Security Professional (CISSP), Certified Information Security Auditor (CISA), Certified Information Security Manager (CISM), Advanced in AI Audit (AAIA), Advanced in AI Risk (AAIR), Advanced in AI Security Management (AAISM) or other relevant training and certifications are preferred.
\n
• Four (4) or more years of Information Security experience, with hands on technical experience strongly preferred.
\n
• Strong working knowledge of security frameworks and standards such as ISO 27001, National Institute of Standards and Technology (NIST), System and Organization Controls (SOC), and Standardized Information Gathering (SIG) is required.
\n
• Experience in Artificial Intelligence (AI) governance, security, and risk management is required.
\n
• Proven ability to produce clear, well-structured security documentation and communicate complex technical topics to varied audiences.
\n
• Experience leading risk assessments, vendor security reviews, and client-facing security discussions with professionalism and tact.
\n
• Familiarity with GRC platforms, role-based access controls, and a broad range of security technologies and tools.
\n
• Working knowledge of areas such as authentication, encryption, firewalls, SIEM, intrusion detection/prevention, vulnerability management, mobile security, and privileged access management.
\n