Information Security GRC Analyst

The role

The Information Security GRC Analyst supports technology risk management policies, procedures, and guidelines. This role helps measure, prioritize, and maintain technology risks in the risk register.

What you will do

• Serve as a point of contact for IT and non-IT stakeholders on technology-related risk questions.
• Support risk assessments, security policy management, third-party risk management, and ISO 27001 ISMS operations.
• Identify and assess technology-related risks and maintain the Information Security Risk Register.
• Assist with periodic risk reporting to executive management.
• Assist with IT Risk Assessments for on-premises and cloud-based infrastructure, platforms, applications, and technology services.
• Assess risks associated with major IT changes and technology implementations.
• Track and process exceptions and waivers related to internal security standards.
• Work with IT Infrastructure to integrate security controls into Business Continuity/Disaster Recovery planning.
• Assist with the operation of the ISMS and PIMS in alignment with ISO 27001:2022 and ISO 27701:2019 standards.
• Support the Security Awareness Program through planning, curriculum development, and content delivery.

Required qualifications

• Bachelor’s degree or equivalent experience.
• 2 years of relevant experience in IT, Risk Management, or Information Security; internships or academic coursework may be considered.
• Familiarity with IT risk and threat assessment methodologies.
• Exposure to or familiarity with security governance, compliance, or control frameworks, including ISO 27000 series, SOC 2 Type II.
• Familiarity with IT security policies, procedures, and standards.
• Technical knowledge in at least one area such as IT infrastructure, systems engineering, networking, or application development.
• Familiarity with operating systems, application architectures, and security technologies.
• Working knowledge of network and security protocols, including TCP/IP, SMTP, FTP, SSH, TLS, SSL, HTTP, IPSec, and other VPN protocols.
• Basic understanding of IT concepts such as networks, systems and databases, as well as foundational cybersecurity principles.
• Strong proficiency in Microsoft Office Suite with advanced skills in Excel for data analysis, tracking and reporting.
• Ability to work in a fast-paced and demanding environment and respond to shifting priorities while meeting deadlines.
• Excellent oral and written communication skills.

Nice to have

• Entry-level security or IT certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or similar
• Interest in pursuing advanced certifications such as CISSP or CISA
• Familiarity with project management tools (e.g., Microsoft Project, Asana, Trello)

About the company

Barnes & Thornburg is committed to equal employment opportunity in both principle and as a matter of policy.