Cybersecurity GRC Analyst

About the role

The Cybersecurity GRC Analyst will support the Information Security Officer in maintaining governance, risk management and compliance standards across IT and digital environments. The role is part of a globally distributed team and requires regular virtual meetings and a hybrid work schedule with two days on‑site each week.

Key responsibilities

• Ensure alignment with the Global Security Framework and enforce related policies and procedures.
• Define risks, remediation plans and compensating controls through Deviation Treatment Action Plans (DTAPs).
• Conduct security risk assessments using group tools and review risks for suppliers, service providers and partners.
• Lead compliance processes for critical digital assets, including stakeholder communication, reporting and evidence management.
• Identify privacy and regulatory requirements, including AI assessments, and assess compliance throughout data and application lifecycles.
• Assist in cyber‑crisis simulations, coordinate incident response and support digital/IT audits.
• Plan, coordinate and execute penetration testing for IT and OT environments.

Required profile

• 4‑7 years of experience in governance, risk management and compliance (GRC) within an information security context.
• Advanced English proficiency (C1 level) and high availability for intensive virtual meetings.
• Relevant certifications such as CISSP, CISM, CGRC, CRISC or equivalent.
• Flexible academic background; certifications are prioritized over formal degrees.

Required skills

• Strong knowledge of GRC frameworks and standards (SOC2, ISO 27001, NIST).
• Experience with cloud security and risk assessments.
• Penetration testing expertise for IT and OT systems.
• Incident response coordination and cyber‑crisis management.