GRC Analyst

About This Role

Working under the guidance of the GRC Security Operations Manager, the GRC Analyst supports day-to-day activities across EA’s Security Governance, Risk and Compliance programs. This job involves participating in the assessment of security, risks, and control effectiveness for applications, infrastructure, and technology projects, with a focus on third-party security risk assessments.

Responsibilities

• Support day-to-day activities across EA’s Security Governance, Risk and Compliance programs
• Assist with the Third-Party Security Risk Assessment program
• Participate in the assessment of security, risks, and control effectiveness for applications, infrastructure, and technology projects
• Document assessment results, recommend corrective actions, and track remediation
• Evaluate policy and control standard exceptions and report to management
• Assist in reviewing and assessing technical security controls for third-party vendors, primarily around logical network architecture
• Help develop and implement processes around risk identification, assessment, and remediation, including issues management, exception management, vendor risk management, policy management, and security incident and vulnerability response
• Support GRC efforts for information risk, network security, and system security by conducting analysis and aiding in the improvement of risk management capabilities
• Help manage EA’s policy exceptions, identifying rationale and risks underlying exception requests, evaluating the effectiveness of compensating controls, and making recommendations
• Coordinate and participate in the creation and maintenance of IT policies and network security standards, such as network perimeter security standards and remote access
• Participate as a subject matter expert on governance and project management teams to ensure risk and compliance are integrated into all projects and initiatives
• Assist in coordinating the ITGC design for in-scope applications – SOX IT

Requirements

• Bachelor’s degree or equivalent experience
• Two (2) years' experience in information technology is preferred
• Foundational knowledge in information technology such as hardware, networking, architecture, protocols, file systems, and operating systems
• Familiarity with application and/or database development and system administration
• Basic understanding of network security architectures (internal/external), firewall technologies, and knowledge of TCP/IP protocol suite (includes secure protocols)

Nice to have:

• Professional certifications in security, privacy risk management and audit areas such as CISSP, CRISC, CISM, CISA, CIPP, CIPT, CPA, CAP
• Passionate about security