Junior GRC Analyst

The Junior GRC Analyst supports the organization’s cybersecurity governance, risk, and compliance activities to help ensure that policies, procedures, and practices align with applicable regulatory requirements and industry best practices. This role assists with risk assessment activities, helps maintain security policies and standards, and supports awareness so stakeholders understand and follow security protocols.

Responsibilities:

• Assist in performing risk assessments to help identify potential security vulnerabilities and threats.
• Assist in the development and maintenance of cybersecurity policies, standards, processes, and procedures based on frameworks like ISO 27001 and NIST.
• Support risk treatment plans, including tracking mitigation actions and following up with the responsible teams.
• Collaborate with cross-functional teams to help ensure security requirements are considered in processes and projects.
• Join security maturity assessments, audits, and gap analyses to improve the organization’s cyber resilience (e.g., with regards to NIS2).
• Support periodic access reviews by assisting with evidence collection, tracking approvals, and following up with system owners.
• Help prepare reports and dashboards on risk, compliance status, vulnerabilities, and remediation progress for the Global GRC Manager.
• Support ongoing control testing activities by following checklists, documenting results, and escalating exceptions.

Required Qualifications:

• Bachelor's degree (or equivalent practical experience) in Computer Science, Information Technology, or a related field.
• 1–2 years of experience in cyber security, IT risk, compliance, or a related area (internships or part-time experience are acceptable).
• Basic understanding of common regulatory and compliance concepts
• (PIPL, GDPR, SOX, CFR Part 11) and willingness to learn.
• Familiarity with risk assessment fundamentals and issue tracking (e.g., collecting evidence, documenting controls, following up on remediation).
• Awareness of cyber security frameworks such as NIST Cybersecurity Framework, ISO 27001, etc.
• Entry-level certifications are a plus (e.g., CompTIA Security+ / Network+, ISO 27001 Foundation, ITIL Foundation).