Sr. GRC analyst

Role: Sr. GRC Analyst

*Role Overview*

We are seeking an experienced Sr. GRC Analyst to support our clients in achieving and maintaining compliance with ISO/IEC 27001:2022, SOC 2 Type 2 (2017 TSC), and NIST CSF/800-53. The role involves driving day-to-day compliance activities, control monitoring, and evidence readiness under the guidance of our vCISO. This is a hands-on role requiring strong technical and documentation skills, stakeholder engagement, and audit support experience.

*Key Responsibilities*

• Evidence Collection & Documentation: Work with business/IT teams to gather, organize, and maintain audit evidence for ISO 27001, SOC 2, and NIST controls; ensure documentation is accurate, complete, and audit-ready.

• Policy & Procedure Implementation: Operationalize vCISO-approved policies and SOPs; monitor adoption across departments; highlight and remediate compliance gaps.

• Compliance Activity Coordination: Coordinate periodic access reviews, change control checks, and process walkthroughs; serve as first point of contact for evidence requests from auditors/assessors.

• Security Control Monitoring: Perform regular reviews of technical and procedural controls (e.g., access logs, vulnerability scans, endpoint checks) and escalate deviations to the vCISO.

• Stakeholder Liaison & Support: Collaborate with IT, HR, and Operations teams to secure inputs for risk assessments, business impact analyses (BIAs), and tabletop exercises; execute Annual Risk Assessment (methodology, register, treatment plan, final report).

• Continuous Improvement Tracking: Maintain trackers for open risks, compliance gaps, and remediation activities; support management reporting and leadership dashboards.

• Framework Integration: Map ISO 27001 controls to SOC 2 and NIST frameworks; maintain crosswalks and prepare integrated auditor packs.

• Audit Support: Prepare evidence packs, respond to auditor queries, and assist in closing non-conformities and findings.

*Certifications*

• ISO
  27001 LA/L1, SOC 2, GDPR, etc.

Experience:

Work Mode: