Senior GRC Analyst

We are seeking an experienced and strategic Senior GRC Analyst to join our information security team. With 3-5  years of hands-on experience, you will serve as a subject matter expert across governance, risk, and compliance — owning critical programs, driving process maturity, and acting as a trusted advisor to leadership and cross-functional stakeholders. This role goes beyond execution; you will shape the direction of our GRC program and ensure the organization's risk and compliance posture keeps pace with an evolving regulatory and threat landscape. 

Responsibilities 

Governance 

• Develop, review, and maintain security policies, standards, and procedures, ensuring they remain current and aligned with business needs 

• Manage the policy exception tracking process, including intake, review, and escalation 

• Coordinate policy acknowledgment and sign-off across business units 

• Support and help improve the organization's security awareness training program 

• Prepare governance metrics and reporting for leadership and board-level stakeholders 

Risk Management 

• Own and maintain the enterprise risk register, ensuring risks are accurately documented, scored, and tracked 

• Conduct risk assessments for new projects, systems, and vendors, as well as periodic reviews of existing risks 

• Facilitate risk scoring and prioritization sessions with business and technical stakeholders 

• Track risk treatment plans and follow up with owners to ensure timely remediation 

• Manage the third-party vendor risk assessment program, including questionnaires and ongoing monitoring 

• Support business impact analysis (BIA) and business continuity planning efforts 

Compliance 

• Map and maintain control libraries aligned to frameworks such as NIST CSF, ISO 27001, SOC 2, GDPR 

• Coordinate internal and external audit engagements, including evidence collection and stakeholder communication 

• Perform control testing and gap assessments, documenting findings and recommending remediation 

• Track open audit findings through to closure 

• Monitor regulatory and framework changes, assess organizational impact, and recommend updates 

• Support data privacy compliance activities related to GDPR, CCPA, or other applicable regulations 

Day-to-Day Operations 

• Own and administer the GRC platform (e.g., Archer, Vanta, Drata, ServiceNow GRC), driving adoption and continuous improvement  

• Lead responses to complex customer security questionnaires, RFPs, and due diligence requests  

• Serve as the compliance lead for incident response activities, ensuring documentation, notification obligations, and regulatory requirements are met  

• Act as the primary GRC point of contact for IT, Legal, HR, Finance, and business unit teams — driving control ownership and accountability across the organization 

Qualifications 

• Bachelor's degree in Information Security, Computer Science, Business, or a related field (or equivalent experience) 

• 3-5 years of experience in GRC, IT audit, information security, or a closely related role 

• Working knowledge of at least two major compliance frameworks (NIST CSF, ISO 27001, SOC 2, HIPAA, PCI-DSS, etc.) 

• Experience collecting audit evidence and managing audit engagements 

• Familiarity with GRC tools and platforms