Summary: As a member of the Information Security team, the Information Security GRC Analyst supports the firm’s technology risk management policies, procedures, and guidelines. This role helps ensure that technology risks are measured, prioritized, and appropriately maintained in the risk register. Working under the direction of the Information Security Governance Manager, the GRC Analyst will help analyze, document, and track risks related to business operations, and will support the monitoring and improvement of risk management processes.

Key Responsibilities

Serve as a point of contact for IT and non-IT stakeholders on technology-related risk questions, escalating issues to senior team members and management as appropriate.

Support other professionals in technology risk management, covering areas such as risk assessments, security policy and documentation management, third-party risk management, and ISO 27001 ISMS operations.

Help identify and assess technology-related risks and maintain the Information Security Risk Register.

Assist with periodic risk reporting to executive management, documenting management’s response to identified risks.

Assist with IT Risk Assessments for on-premises and cloud-based infrastructure, platforms, applications, and key technology services, in line with IT Risk Management Methodology.

Help assess the risks associated with major IT changes and technology implementations.

Track and process exceptions and waivers related to internal security standards, unapproved software, web/email content filtering, password policies, etc.

Work with IT Infrastructure to help ensure that security controls are integrated into Business Continuity/Disaster Recovery planning, ensuring the continuity of security controls where applicable.

Assist with the operation of the Information Security Management System (ISMS) and Privacy Information Management System (PIMS) in alignment with ISO 27001:2022 and ISO 27701:2019 standards.

Track and maintain security control requirements from various sources, including ISO 27001 annex controls, client requirements, legal/regulatory guidelines, and other relevant frameworks.

Assist in responding to security audits, questionnaires, and assessments from clients and external parties, supporting marketing and procurement teams with security-related content for client RFPs and vendor agreements.

Help analyze business and IT processes from an information security perspective and identify potential improvements.

Review policies and procedures to help ensure security control requirements are adequately covered, suggesting updates and improvements as necessary.

Support the periodic review and update of security policies in accordance with firm guidelines.

Support the Security Awareness Program, including assisting with planning and curriculum development.

Assist with content creation and delivery schedules for both broad and targeted security training.

Monitor and report on participation in the awareness program, helping to address any compliance issues.

Assist with periodic assessments of IT vendor relationships, helping ensure that third-party risk management issues are resolved and tracked.

Assist with security reviews of vendor agreements in coordination with the Procurement and Legal teams.

Additional Responsibilities

Perform other duties related to information security as assigned.

The employee must be able to perform all essential job duties and responsibilities of this position satisfactorily and as outlined, with or without reasonable accommodations. Reasonable accommodation requests may be accommodated, absent undue firm hardship.

Qualifications

Bachelor’s degree or equivalent experience.

2 years of relevant experience in IT, Risk Management, or Information Security; internships or academic coursework may be considered.

Entry-level security or IT certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or similar preferred; interest in pursuing advanced certifications such as CISSP or CISA.