Description:
The Governance, Risk & Compliance (GRC) Analyst I supports the organization's information security governance, risk management, compliance, audit, and third-party risk management (TPRM) programs. This role assists in maintaining security policies, conducting risk assessments, supporting internal and external audits, evaluating third-party security risks, and ensuring compliance with applicable regulatory and industry frameworks. This role works closely with IT, Security, Legal, Procurement, Privacy, Internal Audit, and business stakeholders to ensure that information systems, processes, and controls align with organizational policies, industry standards, and regulatory requirements.
The ideal candidate is a proactive, detail-oriented professional with strong analytical and organizational skills and a strong understanding of cybersecurity, governance, risk management, and compliance principles. They communicate effectively with both technical and non-technical stakeholders, demonstrate a collaborative mindset, and are committed to continuous learning and professional growth in cybersecurity governance and risk management.
Responsibilities Will Include
Governance & Policy Management
- Assist with maintaining information security policies, standards, and procedures.
- Help keep governance documentation and policy records up to date.
- Support governance initiatives and promote security best practices.
- Track policy exceptions and follow up on remediation activities.
Risk Management
- Assist with IT and cybersecurity risk assessments.
- Help identify, document, and track security risks and remediation efforts.
- Maintain the IT risk register and support periodic risk reporting.
- Work with stakeholders to monitor risk mitigation activities.
Compliance & Regulatory Support
- Support compliance activities for frameworks such as ISO 27001, NIST CSF, SOC 2, GDPR, and CMMC.
- Assist with compliance assessments, evidence collection, and documentation.
- Help track remediation activities to address compliance findings.
- Support internal and external compliance reviews and audits.
Third-Party Risk Management
- Assist with vendor security assessments during onboarding and periodic reviews.
- Review vendor security documentation, including questionnaires and audit reports.
- Track vendor risk findings and remediation activities.
- Maintain third-party risk records on the GRC platform.
Audit Support
- Coordinate audit evidence requests and documentation.
- Track audit findings and remediation activities.
- Help maintain audit readiness across teams.
- Support customer security assessments and certification audits.
Program Improvement
- Support governance, risk, and compliance initiatives across IT and Security.
- Help monitor compliance metrics, risks, and remediation progress.
- Assist with identifying process improvements and updating documentation.
- Perform other duties in support of the Information Security team.
Education
What We’re Looking For
- Bachelor’s degree in information technology, Cybersecurity, Information Systems, Risk Management, Business Administration, or a related field.
- Equivalent combination of education and experience may be considered.
Preferred Certifications
One or more of the following certifications (or willingness to obtain) is preferred:
- CompTIA Security+
- Certified Information Systems Auditor (CISA) (or pursuing)
- Certified in Risk and Information Systems Control (CRISC) (or pursuing)
- Certified Information Security Manager (CISM)
- ISO 27001 Lead Implementer or Lead Auditor
- Security+ or equivalent cybersecurity certification
Experience
- 2 – 5 years of internship or entry-level experience in IT governance, risk management, compliance, cybersecurity, IT audit, or related fields.
- Experience supporting audits and compliance assessments.
- Familiarity with risk assessment methodologies and control frameworks.