About This Role
The GRC Analyst manages the daily risk and control operations of the company, maintains its documentation library, and supports audit coordination within the Trust Office. This role helps build and is part of the governance operating model as compliance and security efforts scale.
Responsibilities
- Execute routine security control testing and maintain Key Risk Indicators
- Keep the public security trust center and standard security documentation up-to-date so existing and potential customers can self-service security reviews
- Assist with routine incoming customer inquiries, security questionnaires, and vendor assessments
- Assist with external audit readiness (state certifications such as MitID Broker, NSIS, FTN, and ISMS ISAE 3000) and perform regular policy reviews
- Evaluate third-party vendors and cloud subprocessors to ensure they meet security standards before onboarding
- Serve as the first point of contact for vulnerability disclosures, assessing severity and coordinating remediation with engineering
Requirements
- 3+ years of experience in governance of risk and compliance, IT audit, or risk management
- Solid understanding of core security controls and frameworks (e.g., ISO 27001, SOC 2, risk methodologies)
- Ability to translate technical vulnerability data into actionable risk assessments
- Ability to balance security requirements with business agility, finding solutions that work with engineering workflows rather than blocking them
- Strong written and verbal communication skills
Nice to have:
- Familiarity with hyperscalers and cloud platforms, in a SaaS setup like MS Azure, AWS or Google Cloud
- Experience with process automation and configuring AI agents
