GRC Analyst

About the role

A motivated GRC Analyst is sought to support the governance, risk and compliance program. The role helps maintain security policies, track and assess risks, gather audit evidence and support compliance with frameworks such as SOC 2, ISO 27001 and applicable privacy regulations. It is presented as an opportunity to start a career in cybersecurity, with mentorship and growth into broader risk and audit responsibilities.

Key responsibilities

• Support the day-to-day operation of the compliance program for frameworks such as SOC 2, ISO 27001, NIST CSF, PCI DSS and GDPR.
• Collect, review and organise audit evidence and coordinate with control owners for timely submission.
• Assist with internal control testing and track remediation of audit findings and gaps.
• Maintain the risk register, logging, updating and following up on risks and treatment actions.
• Help perform risk assessments, including third-party and vendor security reviews and questionnaires.
• Draft, update and maintain security policies, standards and procedures under the guidance of senior team members.
• Support security awareness training campaigns and track completion metrics.
• Use GRC tools and compliance automation platforms (e.g. Vanta, Drata, ServiceNow GRC, OneTrust) to monitor control status.
• Respond to customer security questionnaires and requests for compliance documentation.
• Prepare reports and dashboards on compliance posture, risk trends and open actions.
• Assist during external audits and customer assessments by scheduling meetings and tracking requests.

Required profile

• Bachelor's degree in Information Security, Information Systems, Computer Science, Business or a related field, or equivalent practical experience.
• 2+ years of experience in GRC, IT audit, risk management, compliance or a related security role (internships count).
• Work experience listed as 0-2 years.

Required skills

• Basic understanding of information security concepts (confidentiality, integrity, availability) and common frameworks (ISO 27001, SOC 2, NIST).
• Proficiency with Microsoft Office / Google Workspace, especially spreadsheets and documents.
• Strong written communication and documentation skills, good organisation and attention to detail.