Junior GRC Analyst; Student Associate

Junior GRC Analyst (Student Associate)

Location:

TBD (Remote / Hybrid in NC / On‑site)

Employment Type:

Hourly rate with Project‑based performance, outcome‑driven (not tied to set daily hours)

Department:
Managed GRC Associate Program

Reports To:

Senior Manager / Client Engagement Lead

Our Managed GRC Associate Program is modeled on the “Tier 1 SOC Analyst” approach applied to Governance, Risk, and Compliance. Student Associates execute structured, repeatable procedures that prepare data for senior decision‑makers—freeing experienced consultants to focus on strategy while building a pipeline of workforce‑ready GRC talent.

As a Junior GRC Analyst, you will support multiple client assignments under the direction of our senior managers and client stakeholders. Work is outcome‑based—measured by deliverables and quality, not by set hours per day, although you will be paid hourly for your efforts. You’ll develop hands‑on experience across policy operations, third‑party risk management (TPRM), evidence collection, vulnerability governance, identity & access hygiene, and collaboration with AI agents that streamline high‑volume tasks.

• Policy Management & Standardization
  • Tailor, format, and maintain client policies using established templates (e.g., ISO/NIST).
  • Drive annual review cycles: reminders, tracking, and sign‑off capture.
  • Perform initial control mapping (e.g., policy → ISO 27001, NIST CSF/800‑53, CMMC) for senior review.
• Core GRC Data Maintenance and hygiene
  • Run and manage imports of GRC core data for example
  • Employee / contactor tables
  • Asset tables
  • Exception tables
• Vendor Risk (TPRM)
  • Coordinate vendor outreach, send questionnaires (e.g., SIG Lite, CAIQ), and follow up to closure.
  • Review customer / client questionnaires and generate AI responses and review
  • Validate documentation (e.g., SOC 2 period/entity scope, bridge letters).
  • Review contracts for standard terms, highlight issues and review with senior GRC team members
  • Apply first‑pass scoring with a key‑answer guide; flag high‑risk responses for escalation.
• Continuous Evidence Collection
  • Execute monthly “evidence hunts” aligned to frameworks (ISO 27001, SOC
    2).
  • Upload artifacts to the GRC platform; trigger compliance alerts when gaps are discovered.
• Vulnerability Governance
  • Produce weekly SLA reports (e.g., criticals > 14 days), open/route tickets, and track resolution.
  • Reconcile scan coverage vs. asset inventory to identify blind spots.
  • Review exception/false‑positive requests for completeness before senior approval.
• Identity & Access Hygiene
  • Prepare clean user lists for access reviews; highlight anomalies and terminations.
  • Perform termination checks (HR → AD) to ensure timely account deactivation.
  • Document role‑based access expectations via stakeholder interviews.
• AI‑Enabled GRC Operations
  • Collaborate on agent design/tuning for: email drafting, evidence triage, tone/sentiment analysis, and process orchestration.
  • Participate in human‑in‑the‑loop oversight to continuously improve agent accuracy and reduce manual effort.

• Education:
  
  Current enrollment in a college‑level program (Information Security, Cybersecurity, MIS, or related).
• Information Security Foundations:
  Familiarity with core security concepts and controls.
• Frameworks:
  Working knowledge of ISO 27001, NIST (CSF/800‑53), SOC 2; ability to map policies/controls.
• Attention to Detail:
  Meticulous documentation, artifact validation, and checklist discipline.
• Inquisitive Mindset:
  Probing follow‑up questions that clarify vendor/client responses and strengthen outcomes.
• Communication:
  Clear, concise writing; professional client/vendor email etiquette.
• Process & Tools:
  Comfort with SOPs, ticketing (Jira/Service Now), spreadsheets, and GRC platforms (e.g., Vanta, Drata, Archer, Service Now).
• AI Curiosity:
  Interest in leveraging AI for automation, evidence analysis, and workflow orchestration.
• Teamwork & Ownership:
  Ability to work under direction from senior managers and clients; deliver reliable outcomes independently.

• Exposure to TPRM platforms/questionnaires (SIG Lite, CAIQ, Prevalent, One Trust).
• Basic data wrangling (Excel/Google Sheets,…