GRC Cyber Analyst

Role Overview

We are looking for a seasoned Senior IT Cyber Governance, Risk & Compliance Analyst to enhance and oversee IT governance, cyber risk management, and compliance within a regulated environment. This position offers a collaborative atmosphere, working alongside IT, Cybersecurity, Risk, Legal, Compliance, and other business domains. The role involves identifying and handling technology and cyber risks, aiding in regulatory adherence, managing audit processes, and ensuring gaps and vulnerabilities are effectively addressed.

Primary Responsibilities

• Support compliance efforts across IT and cyber frameworks such as DORA, ISO 27001, NIST CSF, SOX, and Cyber Essentials.
• Identify, assess, and track IT-related, cyber, security, and operational risks.
• Maintain and enhance the cyber risk register by monitoring risks, issues, and remediation progress.
• Assist with audits including internal, external, regulatory, and third-party assessments by gathering evidence and tracking remediation tasks.
• Track emerging technology, cyber security, and operational resilience risks, escalating concerns as needed.
• Oversee third-party and supplier security assurance processes, including due diligence and remediation follow-up.
• Coordinate reviews of user and privileged access, contributing to automated access certification efforts.
• Conduct first-line compliance checks and control testing against information security policies and standards.
• Help develop and maintain policies, standards, and procedures related to IT risk, cybersecurity, and compliance.
• Create risk reports and remediation updates for senior management and governance bodies.
• Support KPI development and monitoring for IT risk and compliance areas.
• Assist with breach notification, issue escalation, and regulatory reporting when necessary.
• Contribute to organization-wide cyber risk governance and compliance training and awareness.

Candidate Requirements

• Deep understanding of IT risk management, governance, security, and compliance frameworks.
• Proven experience in supporting audits, regulatory compliance assessments, and compliance initiatives.
• Familiarity with infrastructure, applications, networking, cloud technologies, vulnerability management, incident handling, and access control systems.
• Knowledge or experience with SOX / IT General Controls (ITGCs) is a plus.
• Background in financial services, insurance, or other regulated industries is advantageous.
• Strong problem-solving and analytical capabilities to identify control weaknesses and lead rectification efforts.
• Excellent communication skills to clearly articulate technical risks to non-technical audiences.
• Possess a relevant degree or equivalent professional experience.
• Professional certifications such as CISA, CISM, CRISC, CISSP, or ISO 27001 are desirable.