GRC Analyst

RESPONSIBILITES:

• Assist in the development and implementation of GRC standards, frameworks and regulations (SOC2, ISO 27001, NIST Cybersecurity Framework, HIPAA, PCI DSS, etc.)  to support business objectives, aligned with industry best practices and regulatory requirements.
• Assist in conducting risk assessments, supporting the development and adherence of risk mitigation strategies, and maintaining the risk register.
• Support ongoing compliance monitoring activities to ensure adherence to internal policies, relevant regulations, standards, and contractual obligations.
• Assist in evaluating and managing risks associated with third-party vendors and service providers through vendor risk assessment processes.
• Provide support in incident response activities, including documentation, coordination, and post-incident analysis as directed.
• Assist in the development and delivery of security awareness and training programs to educate employees on security policies, procedures, and best practices.
• Support audit activities by gathering evidence, conducting preliminary assessments, and assisting in the remediation of audit findings.
• Manage and resolve GRC support tickets promptly and efficiently. 
• Participate in the review, development, and maintenance of security policies, standards, and procedures to ensure compliance with regulatory mandates and industry standards.
• Maintain and update GRC standard operating procedures to ensure consistency and efficiency. Identify areas for process improvement within the GRC program and assist in implementing enhancements to improve effectiveness and efficiency.
• Work cross-functionally with IT, Engineering, Legal, HR, and other stakeholders to document and validate compliance controls and support their implementation within the GRC platform.
• Leverage AI and automation tools to enhance compliance monitoring, reporting, evidence collection, and risk analysis. 

QUALIFICATIONS:

• Bachelor's degree in Information Security, Computer Science, or related field. 
• Compliance and security certifications (e.g., CompTIA Security+, CISSP, CISA, CISM, CRISC,  other GRC certifications) a plus.
• Minimum of 3 years demonstrated experience in GRC is mandatory.  
• Strong understanding of GRC concepts, principles, and practices.
• Familiarity with using and or administrating GRC tools is a plus. 
• Demonstrated familiarity with relevant regulations, standards, and frameworks is required (e.g., GDPR, SOC2, ISO 27001, NIST Cybersecurity Framework, PCI DSS, HIPAA).
• Prior healthcare compliance experience and knowledge of HIPAA and or HITRUST is a plus. 
• Excellent analytical and problem-solving skills with attention to detail.
• Effective communication and interpersonal skills, with the ability to establish relationships and collaborate with cross-functional teams.
• Detail-oriented with superior organizational and time-management skills - balancing multiple projects, deadlines, and requests.
• Proven ability to navigate ambiguity and complexity, turning uncertainty into clarity and actionable insights.
• Driven with a pro-active and results-oriented approach, demonstrating a can-do attitude and determination to succeed.
• Familiarity with Jira or other project management tools for organizing and managing daily work and projects is preferred.