The GRC Analyst will support the organization in establishing, implementing, and maintaining effective governance, risk management, and compliance practices. The role involves identifying and assessing business and operational risks, monitoring compliance with applicable laws and regulatory requirements, maintaining internal policies and controls, and supporting internal and external audits. The successful candidate will work closely with business units, technology teams, and management to ensure that organizational processes align with regulatory obligations, industry standards, internal policies, and established risk management frameworks.
Job Details
Key Roles and Responsibilities
Support the implementation, governance, evidence management and ongoing compliance requirements for ISO/IEC 42001.
Support SOC 2 readiness, including control implementation, evidence collection, gap/remediation tracking and ongoing control monitoring.
Conduct and support risk assessments and maintain relevant risk and compliance records.
Perform periodic control testing and compliance monitoring to assess the effectiveness and operation of established controls.
Coordinate evidence collection for internal and external audits and track identified findings through remediation and closure.
Work with process owners and stakeholders across Engineering, Product, Legal and other functions to implement and maintain required controls.
Maintain governance and compliance documentation, including policies, procedures, control records and audit evidence.
Support continuous monitoring and audit-readiness activities for ISO/IEC 42001 and SOC 2.
Track compliance actions, findings and remediation commitments to ensure timely closure.
Support broader Information Security GRC initiatives as required.
Requirements
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Risk Management, or a related field.
2 - 5 years of experience in governance, risk management, information security, IT audit, or compliance.
Practical understanding of information security management systems, risk assessment, control implementation, and audit processes.
Familiarity with ISO/IEC 27001, ISO/IEC 42001, SOC 2, and relevant data protection regulations.