GRC Analyst | Remote, USA

Role overview Provide accurate, traceable governance, risk, and compliance operations support for assigned clients in a managed-services setting. The work follows approved procedures and review criteria, covering access records, audit trails, evidence, compliance tracking, and GRC or third-party risk workflows. The analyst is responsible for timely execution and clear documentation, while escalating exceptions and decisions beyond their authority.

Responsibilities - Generate access and permissions reports, reconcile inactive or non-user accounts, and document discrepancies for review. - Review system activity logs and audit trails against defined criteria; record the work performed and route exceptions. - Check, organize, and retain audit and security evidence, ensuring records are complete, accurate, relevant to the period, and retrievable. - Maintain compliance forms, attestations, trackers, audit support materials, and responses to information requests. - Track GRC and third-party risk requests, including scope, owners, due dates, dependencies, status, and supporting records; follow up on aging items and escalate blockers. - Protect sensitive information, follow client-approved access and retention procedures, report handling concerns, and prepare operational status and quality metrics.

Requirements - Relevant experience supporting GRC operations, access governance, audit evidence, compliance reporting, or related workflows. - Ability to document work clearly and maintain accurate, reviewable records with strong attention to completeness and traceability. - Clear communication skills for coordinating with technical and nontechnical stakeholders. - Bachelor’s degree in cybersecurity, information systems, risk management, business, or a related field, or equivalent education, training, certification, military service, and practical experience. - Ability to work within defined procedures, approved access, review criteria, and service priorities, escalating matters outside assigned authority.

Nice to have - Experience with access reviews, inactive-account reconciliation, evidence repositories, exception records, or managed-services delivery. - Familiarity with spreadsheets, workflow or document systems, GRC or identity-governance platforms, and frameworks such as NIST CSF, NIST SP 800-53, ISO 27001, or SOC 2. - Security+, CISA, CRISC, CGRC, or comparable training or certification.

Benefits and work setup - Fully remote within the continental United States, with work performed in client-approved systems during engagement-aligned service windows. - Professional training resources, work-life balance, remote-work technology, employee groups, and volunteer opportunities are offered.