GRC Analyst

Job Summary

We are seeking an experienced Security Governance, Risk, and Compliance (GRC) Analyst to support the development, execution, and continuous improvement of the Information Security GRC program. This role will focus on security risk management, compliance operations, audit readiness, third‑party risk, policy governance, and security metrics reporting.

The ideal candidate will also help transform GRC processes through AI‑driven automation, intelligent workflows, LLM‑based solutions, and data‑driven risk management capabilities
. The candidate will collaborate with security, engineering, compliance, and business teams to improve efficiency, automate manual processes, and strengthen security governance aligned with standards such as ISO 27001, ISO 42001, NIST, GDPR, and EU AI Act
.

• Support the GRC operating model and security risk management processes.
• Manage and support security compliance programs, audits, policies, and governance activities.
• Perform security risk assessments covering applications, systems, suppliers, business initiatives, and process changes.
• Evaluate security controls, identify gaps, track remediation plans, and drive issues to closure.
• Collaborate with cross‑functional teams to improve security posture and compliance maturity.
• Support third‑party risk management, supplier assessments, and security reviews.
• Respond to customer security questionnaires and compliance requests.
• Maintain security metrics, KRIs/KPIs, dashboards, and executive reporting.
• Automate GRC processes including:
  • Evidence collection
  • Control testing
  • Compliance reporting
• Build AI‑powered GRC solutions using:
  • API integrations
  • Python scripting
• Apply AI/NLP techniques to analyze policies, regulations, audit findings, and security requirements.
• Develop AI‑driven risk scoring, prioritization models, and automation pipelines.
• Partner with security, engineering, and data teams to deploy production‑ready AI solutions.
• Ensure AI usage aligns with security governance requirements, ISO 42001, and EU AI Act principles.

• 4+ years of experience in Information Security, Governance, Risk, and Compliance (GRC), or Security Risk Management
  .
• Strong understanding of information security principles, controls, and industry best practices.
• Knowledge of security frameworks and standards including:
• ISO 27001
• ISO 42001
• NIST
• SOC 1 / SOC 2
• CAIQ
• GDPR
• EU AI Act
• SOX
• Experience performing security assessments, control testing, audit support, and remediation tracking.
• Experience defining, implementing, and assessing security controls.
• Ability to communicate security risks and compliance concepts to technical and business stakeholders.
• Hands‑on experience building or customizing automation solutions using:
• APIs
• Python scripting
• Ability to translate GRC requirements into scalable automation solutions.
• Understanding of AI governance, AI risks, and responsible AI practices.
• Strong analytical, organizational, and project management skills.
• Ability to work independently with distributed global teams.

• Experience supporting enterprise security compliance programs.
• Experience with security audit preparation and evidence management.
• Experience automating security metrics, dashboards, and reporting.
• Knowledge of CISSP security domains.
• Experience implementing AI‑driven improvements within security operations or GRC functions.
• Improved security compliance and risk management processes.
• Automated GRC workflows and reporting capabilities.
• AI‑powered solutions to reduce manual compliance effort.
• Enhanced visibility into enterprise security risk posture.
• Continuous improvement of security governance and compliance operations.