Junior GRC Analyst - in ISO​/NIST & AI Audit Ops

Responsibilities

• Support multiple client assignments under the direction of senior managers and client stakeholders.
• Tailor, format, and maintain client policies using established templates (e.g., ISO/NIST).
• Drive annual review cycles: reminders, tracking, and sign-off capture.
• Perform initial control mapping (e.g., policy → ISO 27001, NIST CSF/800-53, CMMC) for senior review.
• Run and manage imports of GRC core data for example Employee / contractor tables, Asset tables, Exception tables.
• Coordinate vendor outreach, send questionnaires (e.g., SIG Lite, CAIQ), and follow up to closure.
• Execute monthly evidence hunts aligned to frameworks (ISO 27001, SOC
  2).
• Produce weekly SLA reports (e.g., criticals > 14 days), open/route tickets, and track resolution.
• Prepare clean user lists for access reviews; highlight anomalies and terminations.
• Collaborate on agent design/tuning for email drafting, evidence triage, tone/sentiment analysis, and process orchestration.

• Current enrollment in a college‑level program (Information Security, Cybersecurity, MIS, or related).
• Familiarity with core security concepts and controls.
• Working knowledge of ISO 27001, NIST (CSF/800-53), SOC 2; ability to map policies/controls.
• Meticulous documentation, artifact validation, and checklist discipline.
• Probing follow‑up questions that clarify vendor/client responses and strengthen outcomes.
• Clear, concise writing; professional client/vendor email etiquette.
• Comfort with SOPs, ticketing (Jira/Service Now), spreadsheets, and GRC platforms (e.g., Vanta, Drata, Archer, Service Now).
• Interest in leveraging AI for automation, evidence analysis, and workflow orchestration.
• Ability to work under direction from senior managers and clients; deliver reliable outcomes independently.