Information Security GRC Risk Analyst

The Challenge

We are looking for a dynamic Information Security GRC Analyst to support IT and InfoSec by performing various governance, risk, and compliance activities as part of the OneTrust InfoSec GRC team.

Your Mission

To collaborate with our sales team to address customer audits, assist with RFPs/RFQs and internal audits, manage the issues and risk acceptance process, and execute risk management processes to support ongoing compliance efforts.

Supports ongoing compliance and audit processes
Works with IT and business owners to collect evidence of effective controls
Updates or defines policy, standard, and process documentation to align with compliance requirements
Responds to customer inquiries and RFP/RFQs to provide appropriate answers
Supports customer audits as needed

You Are

This a team player who can work well within the GRC team.

• Collaborate with IT, InfoSec, and within the GRC team to mature the compliance process
• Follow our ongoing risk and control self-assessment, audit management, security risk assessment, and third-party assessment processes
• Provide front line support to customer meetings and audit requests to ensure that OneTrust’s customers understand the security program and controls and how it meets the requirements of the customer
• Facilitate and manage multiple audits simultaneously
• Become a trusted advisor to IT, InfoSec, and the business
• A Relationship builder: Ability to listen, build rapport, and credibility as a strategic partner vertically and horizontally
• An Innovator: Possess the ability to seek alternatives and recommend best solutions that gain all parties support and lead to win-win results
• Value Driven: You are detail oriented with an eye for quality
• Ability to work with minimal oversight
• Ability to execute given high level direction
• Asks good questions and always learning
• Understanding of applicable laws and regulations, including but not limited to, GDPR, CCPA, PCI-DSS, SOC 2, ISO, and FedRAMP
• Working knowledge of Data Loss Prevention ideas, methodologies and procedures
• Understanding of Data Governance and Data Security/Protection
• Understanding of the different types of sensitive data, and the classifications of that data
• Understanding of concepts of the least privilege and zero trust models
• Understanding of technology domains including governance, risk management, security, privacy, and information technology and business continuity
• Planning, supporting, and or executing audits (customer-driven, internal, external)
• Bachelor’s degree; or 3 years of equivalent work experience or a Master’s degree; or a PhD without experience; or equivalent work experience