GRC Analyst

• Manage and respond to client and operational due-diligence requests, translating security and technology controls into clear responses for clients, auditors, and external stakeholders
• Support SOC 1/SOC 2, SOX, internal, and external audit activities, including evidence collection and coordination with control owners
• Conduct and coordinate technology, cybersecurity, information-security, and operational risk assessments
• Maintain risk registers, control inventories, audit findings, policies, standards, exceptions, remediation plans, and supporting evidence
• Partner with Information Security, Technology, Legal and Compliance, Internal Audit, Operations, and client-facing teams
• Perform third-party risk activities, including vendor security assessments, SOC report reviews, risk documentation, and ongoing monitoring
• Support governance and oversight of DLP and information-protection controls
• Track identified issues and remediation activities through completion and coordinate with appropriate stakeholders
• Develop management reporting related to risk, audits, controls, findings, and remediation
• Identify opportunities to automate and streamline GRC, audit, evidence-collection, and due-diligence processes
• Financial services, asset management, institutional investment management, or other regulated-industry experience is strongly preferred
• Relevant certifications such as CISA, CRISC, CISM, CISSP, CIA, Security+, or ISO 27001 are preferred

• 3-6 years of relevant GRC/security-risk experience across information security, technology risk, IT audit, operational risk, or a related discipline
• Hands-on client and operational due-diligence experience responding to RFPs, RFIs, DDQs, ODD requests, client security questionnaires, or similar security/technology-risk inquiries
• Control and audit assurance experience supporting SOC 1/SOC 2, SOX, internal/external audits, evidence collection, control-owner coordination, issue management, and remediation
• Strong GRC fundamentals, including risk assessments, control design/testing, policy governance, remediation tracking, third-party risk, and frameworks such as NIST CSF, ISO 27001, COBIT, or CIS Controls
• Independent, highly organized communicator capable of managing multiple concurrent questionnaires, audits, assessments, and remediation activities across technical and business stakeholders.

Company - Our client is a cybersecurity services and consulting organization focused on helping enterprises strengthen their security programs through technology, advisory, risk and compliance, and specialized security services. The organization takes a highly consultative, client-centric approach to solving complex cybersecurity challenges.