Security GRC Analyst

Team: Information Security

Location: Work From Home

Commitment: Full Time

Workplace Type: remote

Salary:

Key Responsibilities:

• Perform and mature enterprise risk assessments using frameworks such as NIST CSF, NIST 800-53, SOC 2, and CIS, including documenting findings and driving mitigation strategies across systems, processes, and infrastructure. 

• Demonstrated technical acumen in analyzing vulnerability assessment reports to support troubleshooting, remediation, and risk reduction initiatives. 

• Develop and execute security awareness programs, including training, phishing simulations, newsletters, and communications to drive behavioral change and risk reduction. 

• Deliver actionable reporting and insights, including assessment results, GRC metrics, dashboards, and executive-level presentations summarizing risk posture, control effectiveness, and program maturity. 

• Perform end-to-end cyber third-party risk assessments, including vendor risk assessments, onboarding/offboarding processes, and embedding a shift-left security approach across the vendor lifecycle—particularly for high-risk and complex engagements. 

• Drive process and tooling optimization, contributing to GRC platform design, standardizing workflows, and improving operational consistency and scalability. 

• Support governance and control management, including developing and maintaining policies, standards, and control libraries aligned to regulatory requirements and industry best practices. 

• Enable audit readiness and due diligence, managing evidence collection, standardizing responses, and maintaining repositories for external audits and third-party inquiries. 

• Stay current on evolving regulations, frameworks, and industry trends, incorporating updates into practices and controls. 

• Manage priorities and execution using Agile methodologies, including tracking tasks, resolving issues, escalating risks, and providing timely status updates. 

Required Skills & Expertise:

• Bachelor’s degree in Cybersecurity, Information Systems, or related field. 1–3 years of experience in GRC, risk management, or compliance within cybersecurity. 

• Working knowledge of regulatory frameworks, audit processes, and control environments, including familiarity with industry standards and risk management terminology. 

• Understanding of third-party/vendor risk management (TPRM) processes and enterprise risk concepts, with the ability to support risk identification, assessment, and mitigation activities. 

• General knowledge of security tools and controls across domains such as network security, endpoint protection, email security, vulnerability management, access controls, and log management; foundational understanding of cloud service models (IaaS, SaaS, PaaS). 

• Proven ability to track, measure, and report on IS GRC program effectiveness using tools such as , Archer, SharePoint, and Power BI; able to translate metrics into actionable insights for leadership. 

• Experience contributing to continuous improvement of GRC programs, including identifying enhancements and presenting recommendations to leadership. 

• Experience developing and delivering training materials, with strong written and verbal communication skills to effectively engage technical and business stakeholders. 

• Strong organizational, analytical, and multitasking abilities, with a demonstrated ability to manage competing priorities and collaborate effectively across teams. 

Preferred Qualifications:

 

• Strong consideration for experience with cloud security compliance (Azure/AWS). 

• Experience with Microsoft Office Suite; familiarity with tools such as SharePoint, Power BI, , UpGuard, or Archer. 

• Achieved certifications such as: CISA, CRISC, GSEC/GISP, CISSP, CISM, CCSP, CIDSP, Security+