Security GRC Analyst

Key Responsibilities

• Support rapid risk decision-making by coordinating timely reviews, approvals, and escalations, ensuring decision-makers have the information needed to assess risks and take action.
• Manage the intake, triage, and tracking of security issues and exceptions to accelerate risk-based decisions and timely resolution.
• Coordinate issue and exception management activities, including reviewing submissions for completeness, following up with stakeholders, tracking remediation commitments, monitoring exception expiration dates, and supporting timely case resolution.
• Maintain accurate and complete risk records in case management platforms, ensuring consistent documentation, appropriate case status, and reliable data for operational reporting.
• Partner with security, engineering, and compliance teams to gather information, clarify case requirements, resolve operational blockers, and accelerate risk-based decision-making.
• Monitor case progress, identify stalled requests or decision gaps, and coordinate follow-ups to ensure issues and exceptions move efficiently through established governance and approval workflows.
• Assist with operational reporting and metrics, including tracking case volumes, aging, remediation progress, exception renewals, and other key performance indicators.
• Identify opportunities to improve efficiency and automate repetitive tasks, helping streamline case handling, improve data quality, and enhance the overall stakeholder experience.
• Support ad hoc requests, process improvements, and emerging operational needs.

Requirements & Tech Stack

• Foundational understanding of information security concepts, including security findings, risk remediation, policy exceptions, and risk acceptance.
• Sufficient technical ability to serve as one of many eyes as we assess the certainty of our compensating controls and exposures.
• Highly organized, detail-oriented, and comfortable managing multiple cases, deadlines, and follow-up activities while maintaining accurate records.
• Strong analytical and problem-solving skills, with the ability to review information for completeness, identify inconsistencies, and recognize when issues require additional attention or escalation.
• Strong written and verbal communication skills.
• Comfortable learning new tools, navigating workflow or ticketing systems, and working with spreadsheets and data.
• Adaptable, proactive, and comfortable working in an evolving environment where processes and responsibilities are still being established.
• Continuous improvement mindset and eagerness to learn, contribute ideas, and help build scalable and efficient security risk management practices.
• Direct experience using and critically reviewing code and artifacts generated by large language model (LLM) coding assistants and agentic tools. Graduates need direct experience using and critically reviewing code and artifacts generated by LLM coding assistants and agentic tools. Candidates who have actively experimented with and used tools like Gemini, Cursor, or other agent-based frameworks will be stronger candidates.

Qualifications

• +2 years of experience in information security or security operations, or a related field.