Senior Governance, Risk, and Compliance; GRC Analyst

Summary Of Job Responsibilities

As a Governance, Risk, and Compliance (GRC) Analyst, you will support and enhance the organization’s information security, compliance, and enterprise risk management programs. In this role, you will assess organizational risk, ensure adherence to regulatory and policy requirements, and collaborate across teams to improve security governance and reporting. You will play a key role in audit readiness, policy development, third‑party risk management, and internal control assessments, while helping the organization align its security posture with evolving compliance standards and business goals.

You will interface with multiple internal teams in a structured IT department and will be responsible for interfacing internal and external auditors.

This role requires strong communication skills, attention to detail, and the ability to translate complex technical and regulatory requirements into clear, actionable policies and controls. Familiarity with cloud security governance in Azure, AWS, or Open Shift is highly desirable.

The ideal candidate is a detail‑oriented security and compliance professional who thrives at the intersection of technology, policy, and risk. You understand how to balance business objectives with regulatory requirements and have experience supporting audit and risk functions in complex environments. You are curious, process‑driven, and highly collaborative, with a strong desire to improve security governance and compliance maturity across the enterprise.

You are an experienced professional with the ability to work independently identifying key issues and bringing those to the attention of management.

• 3–5+ years of GRC, audit, or security compliance experience
• Strong knowledge of risk assessment and security control frameworks
• Ability to communicate technical and regulatory content clearly and concisely
• Familiarity with security and compliance in cloud environments (Azure, AWS, Open Shift)
• Demonstrated success supporting audits and policy implementation
• Highly organized and attentive to detail
• Experience in the pension, financial, insurance, or banking sectors.
• Holds or is pursuing relevant certifications (e.g., CISA, CRISC, CISSP)
• Comfortable working across teams to implement governance and compliance strategies
• Proactive in identifying risks and driving remediation
• Committed to continuous improvement and professional development

Employees are held accountable for all duties of the job. Individuals must be able to perform these duties with or without reasonable accommodations.

• Support the design, implementation, and continuous improvement of the organization’s GRC (Governance, Risk, and Compliance) program.
• Assist in maintaining compliance with internal security policies and external regulatory frameworks (e.g., HIPAA, GDPR, CCPA, ISO 27001, SOC 2, NIST CSF, NIST 800-53).
• Collaborate with technical and business teams to implement and document effective security controls, especially in cloud and hybrid environments (Azure, AWS, Open Shift).
• Coordinate and support internal and external audits; track findings, manage responses, and drive remediation efforts.
• Conduct and document security risk assessments, business impact analyses, and third‑party/vendor risk assessments.
• Maintain the information security policy framework; assist with policy drafting, review, and lifecycle management.
• Develop metrics and reporting to track compliance status, control effectiveness, and risk exposure across the organization.
• Assist with data governance and privacy program activities, including data classification, impact assessments, and compliance monitoring.
• Manage GRC tools and repositories, including risk registers, control libraries, and audit logs.
• Provide input on the security implications of new projects, vendors, and technologies.
• Help build a culture of security awareness by contributing to training, internal communications, and staff education efforts.
• Perform other duties as assigned.

• Bachelor’s degree in Information Security, Information Systems, Risk Management, or a related field, or an equivalent…