Information Security GRC Analyst

About the role

The Information Security GRC Analyst will support the Information Security Officer in maintaining governance, risk management, and compliance standards across IT and digital environments. The role operates within a globally distributed team, requiring regular virtual meetings and a hybrid work model with two onsite days per week.

Key responsibilities

• Ensure alignment with the Global Security Framework and enforce related policies.
• Define risks, remediation plans, and compensating controls through Deviation Treatment Action Plans (DTAPs).
• Conduct security risk assessments using group tools and processes.
• Review and manage risks associated with suppliers, service providers, and third‑party partners.
• Lead compliance processes for critical digital assets, including evidence collection and reporting.
• Identify privacy, regulatory, and AI assessment requirements.
• Support cyber‑crisis simulations and coordinate incident response activities.
• Assist Digital and IT audits by providing control evidence.
• Plan, coordinate, and execute penetration testing for IT and OT environments.

Required profile

• 4–7 years of experience in risk management, compliance, or security.
• Relevant certifications such as CISSP, CISM, CGRC, CRISC or equivalent GRC credentials.
• Advanced English proficiency (C1 level) and ability to attend frequent virtual meetings across time zones.
• Flexible academic background; a bachelor’s degree is optional.

Required skills

• Governance, Risk Management, and Compliance (GRC) frameworks.
• Knowledge of SOC 2, ISO 27001, NIST standards.
• Security risk assessment methodologies.
• Cloud security concepts.
• Penetration testing coordination.
• Incident response and cyber‑crisis management.
• Audit support and evidence collection.