GRC Analyst

Key Responsibilities

1. Compliance & Audit Support

• Assist in documenting and maintaining information security policies, procedures, and standards.
• Help prepare for internal and external compliance audits (e.g., SOC 2, ISO 27001, GDPR, HIPAA, or PCI-DSS).
• Gather, organize, and track evidence required for compliance assessments.

2. Risk Management

• Support the team in conducting routine information security risk assessments.
• Assist in identifying, documenting, and tracking security risks in the company’s Risk Register.
• Follow up with internal teams on the status of risk remediation plans.

3. Third-Party Risk Management (TPRM)

• Review vendor security questionnaires and documentation to assess third-party risk.
• Maintain the repository of approved vendors and track renewal/re-assessment dates.

4. Security Awareness & Reporting

• Assist in administering the company’s security awareness training programs and phishing simulations.
• Help compile data and metrics for weekly or monthly GRC dashboards and reports.

A GRC Analyst supports information security governance, risk management, and compliance work. The role helps maintain security documentation, prepare for audits, track organizational and vendor risks, and support security awareness reporting.

Role at a glance

Skills mentioned

What you will likely work on

• Maintain information security policies, procedures, and standards.
• Organize evidence and assist with internal and external compliance assessments.
• Support routine information security risk assessments and keep the risk register current.
• Follow up with internal teams on risk remediation progress.
• Review vendor security questionnaires and documentation, and maintain approved-vendor records and review dates.
• Help administer security awareness training and phishing simulations.
• Compile metrics for recurring GRC dashboards and reports.

Good fit signals

• Suitable for a recent graduate or someone early in an IT or security career.
• Interested in cybersecurity governance, risk management, and compliance frameworks.
• Comfortable organizing documentation and tracking evidence and follow-up actions.
• Interested in evaluating vendor security information and coordinating risk remediation.
• Ready to work with senior analysts and cross-functional teams.