Role Overview

The Security Risk, GRC & Compliance Analyst supports the day-to-day execution of the organization's cybersecurity risk, governance and compliance program.

This role is responsible for maintaining accurate risk and compliance information, coordinating audit readiness, managing evidence, supporting security assessments and tracking remediation.

The ideal candidate is highly organized, detail-oriented and able to independently manage recurring GRC activities while appropriately escalating material risks and issues.

Key Responsibilities

Maintain the cybersecurity risk register and track remediation activities.
Support cybersecurity risk assessments and document findings.
Support SOC 2 and PCI readiness activities, where applicable.
Maintain the security control framework and documentation.
Coordinate control testing and evidence collection.
Support external audits and security assessments.
Track audit findings, remediation plans and due dates.
Manage customer security questionnaires and security due diligence requests.
Support third-party cybersecurity risk assessments.
Maintain security policies, standards and related documentation.
Prepare cybersecurity metrics, dashboards and management reporting.
Maintain audit and compliance evidence in a centralized manner.
Identify opportunities to automate evidence collection, questionnaires, reporting and recurring GRC activities.
Escalate material security, compliance or control issues to Security leadership.
Partner with Technology, Security and business teams to obtain required information and close identified gaps.

Requirements

4–7 years of experience in cybersecurity GRC, information security, risk, compliance or a related discipline.
Experience with SOC 2, cybersecurity controls and audit readiness.
Familiarity with PCI requirements preferred.
Experience managing risk registers, evidence, control testing and remediation tracking.
Strong documentation and organizational skills.
Ability to manage multiple workstreams and deadlines independently.
Strong written and verbal communication skills.
Financial services, fintech or regulated-industry experience preferred.
Familiarity with GRC platforms and automation tools preferred.
Remote- US Shift

Risk & Compliance Program Manager

Start with your email