Security GRC Analyst

Job Summary

Supporting the organization's Information Security Risk Management program, the full-time remote Security GRC Analyst will execute cyber risk functions such as regulatory compliance, third-party risk assessments, and security awareness initiatives while collaborating with compliance, legal, and technology teams.

Key Responsibilities:

• Perform and mature enterprise risk assessments using frameworks like NIST CSF and SOC 2, documenting findings and driving mitigation strategies
• Analyze vulnerability assessment reports to support remediation and risk reduction initiatives, and develop security awareness programs
• Deliver actionable reporting and insights, including GRC metrics and executive-level presentations summarizing risk posture and program maturity

Required Qualifications:

• Bachelor's degree in Cybersecurity, Information Systems, or related field with 1-3 years of experience in GRC, risk management, or compliance within cybersecurity
• Working knowledge of regulatory frameworks, audit processes, and control environments
• Understanding of third-party/vendor risk management processes and enterprise risk concepts
• General knowledge of security tools and controls across domains such as network security and vulnerability management
• Proven ability to track, measure, and report on IS GRC program effectiveness using tools like ServiceNow and Power BI