GRC - Security Analyst

What you will do

• · Perform cybersecurity and technology risk assessments to identify, document, and evaluate risks across systems, applications, vendors, and business processes.
• · Maintain and support the organization's information security policies, standards, procedures, and control framework.
• · Support compliance efforts related to frameworks and regulations such SOC 2, HIPAA, HITRUST, PCI DSS, as applicable.
• · Assist with internal and external audits, regulatory examinations, security assessments, and customer compliance reviews.
• · Gather, review, and maintain evidence demonstrating the effectiveness of security and compliance controls.
• · Track security risks, audit findings, control deficiencies, exceptions, and remediation plans through closure.
• · Partner with control owners to evaluate control effectiveness and recommend improvements.
• · Conduct third-party and vendor security risk assessments, including reviewing security questionnaires, certifications, audit reports, and supporting documentation.
• · Maintain the organization's risk register and help ensure risks are appropriately scored, assigned, monitored, and reported.
• · Support security awareness, policy acknowledgment, and governance initiatives.
• · Respond to customer and partner security questionnaires and due diligence requests.
• · Assist with monitoring changes to regulatory requirements, security standards, and industry best practices.
• · Develop and maintain GRC metrics, dashboards, reports, and documentation for management and other stakeholders.
• · Support security exception and risk acceptance processes.
• · Collaborate with technical security teams to translate technical vulnerabilities and security issues into understandable business risk.
• · Identify opportunities to automate and improve GRC processes.

You will be a good fit if

Requirements

• · Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Risk Management, or a related field, or equivalent professional experience.
• · 3+ years of experience in cybersecurity, governance, risk management, compliance, IT audit, or a related discipline.
• · Relevant professional certification such as Security+, CISA, CRISC, or CGRC.
• · Working knowledge of cybersecurity frameworks and standards such as HITRUST, SOC 2, PCI-DSS or similar frameworks.
• · Experience performing security risk assessments or evaluating security controls.
• · Familiarity with regulatory and compliance requirements relevant to the organization's industry.
• · Strong analytical, organizational, and documentation skills.
• · Ability to communicate security and risk concepts effectively to both technical and non-technical stakeholders.
• · Strong attention to detail and ability to manage multiple assessments, findings, and deadlines simultaneously.
• · Proficiency with Microsoft Office or similar productivity and reporting tools.

Additional Notes