We are seeking a detail-oriented and knowledgeable GRC Analyst to join our security and compliance team. The ideal candidate will be responsible for conducting vendor risk assessments, supporting internal governance, risk, and compliance initiatives, and ensuring adherence to industry frameworks and standards. This role requires deep technical knowledge of information security, strong understanding of IT control frameworks, and hands-on experience implementing risk and compliance measures across various domains.

Key Responsibilities :

- Conduct comprehensive vendor risk assessments and third-party security reviews.

- Map and assess controls against major industry frameworks, including :

ISO 27001/2
NIST SP 800-53
NIST CSF
SANS Critical Security Controls
CIS Controls
COBIT
SOC 2 (TSC 2017)
PCI DSS

- Assist in the development, documentation, and maintenance of security policies, standards, and procedures.

- Evaluate the effectiveness of IT General Controls (ITGCs) and ensure compliance with internal and external audit requirements.

- Collaborate with cross-functional teams to identify, assess, and mitigate information security risks.

- Participate in internal risk assessments, audits, and remediation planning.

- Maintain up-to-date documentation for GRC processes, workflows, and risk registers.

- Provide support for security awareness and compliance training programs.

- Monitor regulatory and compliance changes and recommend appropriate responses.

Required Qualifications :

- Bachelor's degree in Information Security, Computer Science, Information Systems, or related field (preferred).

- Proven experience conducting vendor risk assessments and third-party due diligence.

- Strong understanding of information security principles, risk management practices, and control frameworks.

- Excellent working knowledge of security standards and best practices :

ISO 27001
NIST (800-53, CSF)
SOC 2 (TSC 2017)
PCI DSS
CIS Controls
SANS CSC
COBIT

Preferred Certifications (One or more) :

CISA - Certified Information Systems Auditor
CISM - Certified Information Security Manager
CISSP - Certified Information Systems Security Professional

Desired Skills :

- Proficiency in evaluating technical security controls, particularly around logical access control, encryption, network security, and system hardening.

- Ability to analyze complex security issues and clearly communicate findings and recommendations.

- Strong verbal and written communication skills for reporting and stakeholder interaction.

- Highly organized, detail-oriented, and able to manage multiple tasks simultaneously.