Security, Privacy & GRC - Security
GRC Analyst
IC / Practitioner
Independently auditedProtects the company's systems, data, and customers from real adversaries. Owns a defined area of the function and the outcomes it produces.
Audited package
Built, independently audited role package. Everything on this page is written for this seat.
Your Stack (Swappable)
This role works against whatever tools you already run. We list the tool categories the role operates in, never a named vendor, so you are never asked to replace a system that works.
- GRC & Compliance
- ITSM / Service Desk
- Docs & Knowledge
- Survey & Forms
Deliverables
- Detection rules and tuning notes
- Risk and architecture reviews
- Incident write-ups
- Control evidence packs
Responsibilities
- Conduct risk assessments on systems and processes, with likelihood/impact scoring and a maintained risk register
- Test security controls for design and operating effectiveness, with a documented sampling methodology
- Collect, organize, and index audit evidence, mapped to the control it proves
- Support external audits and certifications (e.g. SOC 2, ISO 27001) as the evidence and testing hands
- Answer customer security questionnaires from a vetted answer library, never overstating posture
- Conduct vendor / third-party security assessments (SIG, CAIQ, custom) and produce risk summaries
- Build framework crosswalks so one artifact satisfies multiple frameworks (SOC 2 ↔ ISO 27001 ↔ NIST CSF)
- Review policies against current practice and regulatory change, and draft aligned updates
The essence of this seat
The GRC Analyst is the hands-on individual contributor who keeps the control environment honest.
Signature move
Trace the control to the risk before you test it. The first move on any control is to name what harm it retires and what it does over time, because that is what tells you which artifact proves it operated - not merely that it exists today
What good looks like
distinguishes a point-in-time snapshot from proof a recurring control operated over the window; asks for the dated review records (with revocations) as a light export, not a screenshot; flags a missing quarter honestly and routes it to remediation rather than backdating; delivers evidence indexed to the control and reused across frameworks
Decision rights
- - how a control is tested, the sampling methodology, whether collected evidence satisfies a control, how a risk is scored on the register, and the first-draft narrative for a finding or questionnaire answer
Working vocabulary
What this role does
The GRC Analyst is the hands-on individual contributor who keeps the control environment honest. The work is concrete and evidentiary: run a risk assessment on a system or process, test whether a control actually operated the way the policy claims, collect and organize the artifacts that prove it, and turn a customer's security questionnaire into defensible answers. When an auditor asks "show me evidence that access reviews happened every quarter," this is the person who either has that evidence organized or scrambles to collect it. The role sits inside the security organization but spends the day pulling on other people's systems - IT, engineering, legal, finance, and business-unit owners. A GRC Analyst does not own the risk decisions and does not build the automation platform; they generate the evidence and analysis that let others decide. That distinguishes the role sharply from its neighbors: a GRC Engineer builds the automation and compliance-as-code that collects evidence for them; a GRC Manager/Lead runs the function and owns the audit relationship. This role is the one doing the testing. What separates great from average: a mediocre analyst treats frameworks as checkbox exercises and produces documentation nobody reads. A great one understands the actual risk behind each control, collects evidence in a way that does not burden engineering, and can explain to a VP - in business terms - why a specific gap matters.
Best-fit customer
security teams that need consistent triage, review, and evidence quality
Need more than one role?
Buying the whole team or the complete department lowers your effective cost per role at every tier of the ladder.