GRC Analyst; Third-Party & Client Questionnaire Management

Job Summary

The GRC Analyst – Third-Party & Client Questionnaire Management is responsible for supporting and managing security, risk, compliance, and due diligence questionnaires received from clients, prospects, vendors, and business partners. This role serves as a subject matter resource for industry-standard compliance frameworks and plays a critical role in ensuring responses are accurate, consistent, auditable, and aligned with the organization’s approved control language and evidence.

The position emphasizes GRC platform enablement, automation, quality assurance, and continuous improvement to streamline questionnaire response processes, reduce cycle times, and support the organization’s overall risk and compliance posture.

• Support the completion of security, risk, compliance, and due diligence questionnaires from clients, prospects, vendors, and partners.
• Serve as a subject matter resource for responding to questionnaires related to HITRUST, PCI DSS, SOC 2, NCQA, and general security and privacy controls.
• Coordinate with internal stakeholders, including IT, Security, Compliance, Legal, and Operations, to validate questionnaire responses and obtain supporting documentation or evidence.
• Ensure all responses are accurate, consistent, current, and aligned with approved control language, policies, and audit artifacts.
• Manage timelines and prioritize questionnaire requests to meet internal and external deadlines.

• Configure, maintain, and enhance questionnaire libraries within the GRC platform to support automated and semi-automated responses.
• Map questionnaire questions to existing controls, policies, procedures, and evidence within the GRC system to enable reuse, consistency, and standardization.
• Continuously enhance automation rules and response logic to reduce manual effort and improve response turnaround time.
• Review system-generated responses for accuracy, completeness, and appropriateness prior to submission.
• Maintain version control and approval workflows for standardized questionnaire responses.
• Track questionnaire requests, response status, and performance metrics through the GRC tool.

• Perform periodic reviews of standardized questionnaire content to ensure alignment with current control posture, certifications, and audit outcomes.
• Update approved responses following control changes, audit findings, framework updates, or regulatory changes.
• Identify recurring questions, inefficiencies, or content gaps and proactively address them through control enhancements, documentation updates, or process improvements.
• Provide reporting and metrics to leadership on questionnaire volume, turnaround time, automation effectiveness, and emerging risk trends.
• Support continuous improvement initiatives related to third-party risk management, client assurance, and compliance operations.

• Minimum of 2 years of experience in Governance, Risk, and Compliance (GRC), information security, third-party risk management, or compliance operations.
• Demonstrated experience completing and managing security, risk, compliance, and due diligence questionnaires for clients, prospects, vendors, or partners.
• Working knowledge of common compliance and assurance frameworks, including HITRUST, SOC 2, PCI DSS, NCQA, and general security and privacy control frameworks.
• Experience coordinating with cross-functional stakeholders (e.g., IT, Security, Compliance, Legal, Operations) to validate responses and obtain supporting evidence.
• Hands‑on experience using a GRC platform to manage controls, evidence, workflows, and questionnaire responses.
• Ability to ensure accuracy, consistency, and version control of standardized responses and supporting documentation.
• Strong written communication skills with the ability to clearly articulate technical and control-related concepts to internal and external audiences.
• Strong organizational skills and the ability to manage multiple questionnaire requests and deadlines simultaneously.
• Proficiency with standard business tools,…