Information Security GRC Analyst

Pay Range: $45.00hr - $50.00hr

Job Overview:

Our client is seeking a detail-oriented and analytical Information Security Analyst to join their security team. This role is responsible for developing and maintaining information security policies, standards, and procedures, as well as managing and supporting the organization's response to security audits, assessments, and compliance inquiries. The successful candidate will bring a governance, risk, and compliance (GRC) focus, a strong foundation in information security governance, regulatory frameworks (e.g., NIST, ISO 27001, SOC 2, HIPAA), and the ability to communicate effectively with both technical and non-technical stakeholders.

Core Responsibilities:

• Develop, review, and update security policies, procedures, and standards in alignment with regulatory and industry frameworks (e.g., NIST, ISO 27001, CIS).
• Collaborate with internal stakeholders (IT, Legal, HR, central technology office) to ensure policies are practical, understood, and enforced.
• Track policy lifecycle and version control.
• Lead or assist in responding to third-party audits, internal audits, and customer security questionnaires.
• Gather and organize required documentation, evidence, and technical input to support audits.
• Work with external auditors during SOC 2, ISO 27001, or other compliance assessments.
• Support risk assessments and control gap analysis across business units.
• Participate in the implementation and tracking of corrective actions or remediation plans.
• Maintain documentation for risk management and compliance reporting.
• Help develop and deliver security awareness training to staff, focusing on policy adherence and compliance readiness.
• Promote a culture of security and compliance across the organization.

Technical Skills Required:

• 4 7 years of experience in information security, GRC, or audit/compliance support.
• Familiarity with standards such as NIST 800-53, ISO 27001, SOC 2, HIPAA, PCI-DSS, or GDPR.
• Strong writing skills with the ability to create clear and concise policies.
• Experience participating in security audits and assembling evidence packages.
• Excellent organizational, communication, and collaboration skills.

Technical Skills Preferred:

• Bachelor's degree in Cybersecurity, Information Systems, or related field.
• Certifications like CISSP, CISA, CISM, ISO 27001 Lead Implementer, or Security+.

Additional Technical Skills:

• Coordinate with internal IT to schedule security scans (penetration testing, vulnerability scans, etc.) and review, interpret, and respond to findings.
• Knowledge and understanding of Open Worldwide Application Security Project (OWASP) Top 10.
• Knowledge and understanding of API Security (OAuth2, OpenID Connect).
• Knowledge and understanding of container security.
• Ability to review CI/CD pipeline configurations (i.e., Jenkins, GitHub Actions, Azure DevOps) for security control compliance.
• Ability to review secrets management practices (i.e., HashiCorp Vault, AWS Secrets Manager, etc.) for policy compliance.
• Understanding of application layer threats and controls.

Minimum Requirements:

• Strong verbal and written communication skills, with the ability to effectively communicate with all individuals from technical experts to executive management.
• Bachelor's Degree with a focus in IT or equivalent combination of experience/knowledge.
• Knowledge of and experience with Agile processes.
• Strong analytical, design, and problem-solving skills.
• Ability to work independently, demonstrate self-reliance, and show initiative with minimum supervision.
• Ability to quickly learn new technologies and apply them appropriately to business situations.
• Strong team player who enjoys working in a fast-paced team atmosphere.
• Ability to work under pressure and meet strict deadlines.
• Ability to listen effectively and seek clarification.
• Ability to build rapport with stakeholders.