Cybersecurity GRC Analyst II

The role of a Cybersecurity GRC Analyst is essential to maintaining and elevating the security posture of an organization operating across a decentralized portfolio of 29 independently operated businesses. GRC Analysts are responsible for assessing risk, validating cyber controls, and driving compliance with the frameworks and regulatory environments that govern the organization. This document outlines the job expectations for a Cybersecurity GRC Analyst at the Level II, covering their role, responsibilities, and essential skills.

At the Level II, the analyst is expected to operate with greater independence and ownership than at the entry level, taking assigned governance, risk, and compliance work streams from start through to completion.

A Cybersecurity GRC Analyst is expected to assess the design and implementation of cyber controls across Roper's businesses during cyber health check visits. At the Level II, the analyst leads assigned portions of these reviews and exercises independent judgment on control efficacy. This role includes on-site visits to portfolio businesses, and travel can reach up to 30 percent depending on the assessment schedule, though it is not guaranteed and will vary throughout the year.

• Conducting cyber health checks with the cyber team, both remote and on-site, across a variety of businesses and their independent environments.
• Validating control design and implementation through discussion and evidence review.
• Assessing control gaps and documenting findings and recommended remediation clearly for both technical and business audiences.
• Validating the efficacy of cyber remediation measures and confirming that findings are appropriately closed.

Maintaining the organization's risk and compliance stance against various frameworks and regulatory environments is a central responsibility. The analyst helps ensure businesses of differing size and maturity are measured consistently against Roper standards.

• Performing cyber and privacy assessments against emerging regulations and evolving compliance requirements.
• Conducting risk assessments and gap analyses across companies with differing security maturity.
• Tracking cyber findings and recommendations to ensure that appropriate mitigation actions are taken while supporting necessary compliance activities.
• Preparing and delivering risk and compliance reporting to security and business stakeholders.

Sound policy is the foundation of a strong governance program. The analyst owns the upkeep of cybersecurity policy and supports the consistent application of governance standards across the portfolio.

• Owning cybersecurity policy management and maintenance, keeping policies current and aligned to the threat landscape.
• Supporting the consistent application of Roper cyber controls and governance standards across all businesses.
• Collaborating with other cyber teams to ensure security best practices are implemented.

Roper is an active acquirer, and newly acquired businesses must be brought onto Roper cyber controls. The analyst supports this onboarding using the standard Roper methodology.

• Supporting the onboarding of newly acquired businesses to Roper cyber controls on the established timeline.
• Assisting with security and compliance diligence for acquisition targets as needed.

A Cybersecurity GRC Analyst can pursue various career paths within the cybersecurity field. Common trajectories include:

• Senior Cybersecurity GRC Analyst:
  Senior analysts lead the GRC program, own portfolio relationships, mentor junior analysts, and contribute to the development of security policies and procedures.
• Cybersecurity Governance Manager:
  Progression to managerial roles overseeing broader governance, risk, and compliance strategies and initiatives within an organization.
• Security Operations Manager:
  Managers are responsible for the overall operations of the security program, including managing personnel, resources, and processes.
• Chief Information Security Officer (CISO):
  For those with significant experience and expertise, the role of CISO involves leading the organization's entire cybersecurity framework and strategy.

The cybersecurity landscape is constantly evolving, and Cybersecurity GRC Analysts must stay current with the latest frameworks, regulations, and practices. Roper assesses its…