GRC Analyst II, ISO

Accountabilities

- GRC Advisory and Client Engagements:
Support governance, risk management, compliance, cybersecurity, and advisory projects across multiple industries, helping clients strengthen their internal controls and achieve their risk and compliance objectives.

- Risk Assessments and Control Evaluations:
Assist with risk assessments, control testing, compliance reviews, and process evaluations to identify potential weaknesses, assess control effectiveness, and support the development of appropriate remediation strategies.

- Documentation and Evidence Review:
Review client policies, procedures, business processes, supporting evidence, and other documentation to evaluate alignment with applicable standards, regulatory requirements, and internal control expectations.

- Testing and Analysis:
Perform testing and analysis of business processes and controls, document results accurately, and identify risks, control deficiencies, and opportunities to improve operational effectiveness.

- Reporting and Recommendations:
Prepare work papers, reports, summaries, and client deliverables that clearly communicate findings, risks, and practical recommendations for improvement.

- Client and Team

Collaboration:

Communicate observations and recommendations to engagement team members and clients, collaborate with colleagues to meet project objectives, and contribute to the successful delivery of advisory engagements.

- Regulatory and Industry Awareness:
Maintain awareness of emerging cybersecurity threats, industry practices, regulatory developments, and relevant governance and compliance standards to support effective client service.

- Professional Development:
Build knowledge across governance, risk management, compliance, cybersecurity, auditing, and business processes through hands-on project experience, professional training, and collaboration with experienced team members.

- Educational Background: A bachelor's degree in cybersecurity, information systems, information technology, business, accounting, risk management, or a related discipline is preferred.

- Relevant

Experience:

Approximately 0–3 years of experience in cybersecurity, information technology, risk management, compliance, auditing, consulting, accounting, or a related field.

- Foundational GRC Knowledge: A basic understanding of governance, risk management, compliance, cybersecurity, audit principles, or internal controls, with an interest in developing deeper expertise in these areas.

- Analytical and Problem-Solving

Skills:

The ability to analyze information, assess risks, evaluate processes, identify discrepancies, and contribute to practical recommendations.

- Documentation and Reporting:
Strong written communication and documentation skills, with the ability to organize information clearly, accurately record findings, and prepare professional reports and work papers.

- Communication

Skills:

Professional proficiency in written and spoken English, including the ability to communicate effectively with clients, colleagues, and senior team members.

- Organization and Time Management:
The ability to manage multiple priorities, meet deadlines, maintain accurate records, and deliver high-quality work across concurrent engagements.

- Attention to Detail: A careful and methodical approach to reviewing documentation, testing controls, analyzing evidence, and identifying potential risks or inconsistencies.

- Collaboration and Independence:
The ability to work effectively within a team while taking ownership of assigned responsibilities and progressing tasks independently when appropriate.

- Client Service Mindset: A professional, responsive, and solutions-oriented approach, with a willingness to understand client needs and contribute to positive…