GRC Analyst

Role overview

Essential responsibilities

• Identify and maintain high-value asset lists and associated threats and vulnerabilities with company teams.
• Document enterprise processes and work with partners to design and mature security controls that mitigate risk.
• Perform routine or ad hoc security risk assessments as needed or requested by management.
• Maintain the GRC platform with control, risk, and related information.
• Produce periodic executive reports on security-risk program health and the company’s risk position.
• Prepare for and assist with internal and external audits; evaluate control deficiencies and document their business impact.
• Respond to client security questionnaires and audit-report requests.
• Help business partners balance business strategy with appropriate risk controls; use judgment to influence partners.
• Monitor audit and compliance trends, manage third-party vendor assessment and compliance, and assist with policies, procedures, and standards.

Required qualifications

• Bachelor’s degree or relevant equivalent experience.
• 3+ years of Audit, Risk, or Compliance experience.
• 3+ years of experience with HIPAA regulatory controls, SSAE, SOC 1, and SOC 2.
• Able to manage multiple work efforts, change direction quickly, and identify detailed as well as broader risk patterns.
• Strong organizational, analytical, oral, and written communication skills; able to influence management and lead change.
• Self-starter with a desire to learn and teach others, flexibility, and a positive, energetic approach.

Preferred qualifications

• 5+ years of experience with IT general controls and other IT controls aligned with frameworks such as NIST, ISO, and COBIT.
• Healthcare industry experience and experience working with external audit firms are preferred.

Compensation

• Anticipated hiring range is $80,800 to $101,000 annually; the final offer may vary based on qualifications and internal equity.
• The role is eligible for short-term incentives, which vary based on individual and business goals.

Workplace

• The company describes its work environment as remote-first.
• The posting mentions reimbursement for high-speed internet and provision of a computer and monitors.

Benefits

• Benefits include medical, dental, vision, disability, life insurance, 401(k) matching, holidays, tuition reimbursement, paid new-parent leave, pet insurance, and mental health support.