About This Role
This GRC Analyst role supports and strengthens an organization's information security governance, risk management, and compliance practices. The analyst will work with security and IT personnel to review audit findings, identify policy gaps, and develop actionable documentation to address risks. This hands-on position focuses on developing sustainable policies, procedures, and remediation practices.
Responsibilities
- Review and analyze existing audit findings, security assessments, and compliance documentation to identify gaps, risks, and areas requiring remediation
- Evaluate current information security policies, procedures, standards, and controls to identify inconsistencies, deficiencies, and missing documentation
- Develop actionable recommendations and remediation plans to address audit findings and improve security and compliance practices
- Rewrite and update existing security policies and procedures to align with organizational requirements, industry best practices, and applicable regulatory standards
- Create new policies, procedures, standards, and supporting documentation where gaps or deficiencies exist
- Translate audit findings and security requirements into clear, structured requirements documents, remediation plans, and management reports
- Develop documentation that clearly communicates security expectations, responsibilities, and implementation steps to technical teams, business stakeholders, and end users
- Collaborate with IT, information security, compliance, and business teams to validate requirements and ensure proposed policies and procedures are practical and implementable
- Help establish consistent documentation practices and repeatable processes for addressing audit findings and maintaining ongoing compliance
- Track remediation activities, document progress, and support the development of evidence demonstrating that identified issues have been addressed
- Recommend improvements to governance processes, policy management, risk documentation, and internal controls
Requirements
- Experience in Governance, Risk & Compliance (GRC), information security, IT risk management, audit remediation, or related discipline
- Demonstrated experience reviewing audit findings and translating identified gaps into actionable remediation plans
- Strong experience writing, revising, and maintaining security policies, procedures, standards, and requirements documentation
- Ability to analyze existing documentation, identify deficiencies, and develop practical recommendations for improvement
- Excellent technical writing, documentation, and communication skills
- Ability to communicate complex security and compliance concepts in clear, understandable language for technical and nontechnical audiences
- Strong analytical, organizational, and problem-solving skills
- Ability to work independently, manage multiple priorities, and collaborate with stakeholders across the organization
- Applicants must be eligible to work in the U.S. for any employer directly
Nice to have:
- Experience supporting internal or external audits and compliance assessments
- Familiarity with information security frameworks and standards such as NIST Cybersecurity Framework, NIST SP 800-53, ISO 27001, SOC 2, or CIS Controls
- Experience with risk assessments, control documentation, corrective action plans, and evidence collection
- Familiarity with policy management, risk registers, control mapping, and compliance tracking
- Experience working in an environment with an established but lean information security or GRC function
Important Details
About the Company
Gravity cannot transfer nor sponsor a work visa for this position.
