Information Technology Governance Analyst

Position Overview:

The GRC Analyst II supports the design, implementation, and continuous improvement of the organization's Governance, Risk, and Compliance program. This role advances the security governance initiatives, manages cybersecurity risks, coordinates compliance activities, supports external audits, and partners with IT and business stakeholders to strengthen the organization's security posture. Reporting to the GRC Manager , this is a hands-on, build-oriented role suited to a detail-oriented and analytical professional who wants meaningful ownership early and room to grow with the program.

Key Responsibilities:

• Develop, maintain, and improve information security policies, standards, and procedures.
• Perform information security risk assessments and maintain the enterprise risk register.
• Support SOC 2, ISO 27001, and other compliance and audit readiness activities.
• Coordinate audit evidence collection, issue tracking, and remediation activities.
• Conduct third-party and vendor risk assessments, and track remediation to closure.
• Monitor control effectiveness, compliance metrics, and key risk indicators.
• Perform periodic user access reviews and document outcomes.
• Coordinate the IT business continuity and disaster recovery (BCDR) program, including plan reviews, testing, documentation, and corrective action tracking.
• Coordinate and facilitate security incident management activities, including incident documentation, post-incident reviews, lessons learned, and corrective action tracking.
• Deliver security awareness and compliance training across the organization.
• Partner with IT and business stakeholders to embed governance and security controls into day-to-day operations.

Qualifications:

• Bachelor's degree in Information Systems, Computer Science, or a related field, or equivalent practical experience.
• 3 to 5 years of experience in GRC, IT audit, information security, or compliance.
• Hands-on experience supporting a SOC 2 audit, an ISO 27001 program, or comparable IT audit work.
• Strong working knowledge of information security risk management and audit support practices.
• Strong analytical, written communication, and stakeholder management skills, with the ability to work effectively across technical and non-technical audiences.
• Experience with Microsoft Azure, Azure DevOps, or a dedicated GRC platform is a plus.
• Professional certifications such as ISC2 Certified in Cybersecurity (CC), CompTIA Security+, or CISA are an advantage but not required.

Work Arrangement:

• Employment Type: Full-time
• Work Setup : Fully Remote
• Work Schedule: 9:00 AM to 6:00 PM US Eastern Time (ET)

Why Join Us?

• Competitive compensation and benefits package.
• Integral role in a highly stable team within a rapidly growing company.
• Opportunities for professional development and career progression.
• Emphasis on work-life balance is a core element of our culture.
• Involvement in cutting-edge projects leveraging the latest cloud technologies.