Policy, Risk and Control (PRC) Methodology Analyst

About the role

EY's Information Security team protects data and information systems, blending risk strategy, digital identity, cyber defense, application security and technology solutions. Within Information Security, the Technology Assurance, Risk and Policy (TARP) function promotes a holistic Governance, Risk and Compliance (GRC) program. The PRC Methodology Analyst works in the PRC Enablement & Awareness team, supporting the GRC program and its tooling by integrating the IT PRC Framework operating model so that policies, standards, processes, risks and controls stay aligned with the core GRC platform.

Key responsibilities

• Coordinate, maintain and update the IT PRC Framework, integrating IT risk domains, risk categories, processes, control objectives, common controls, IS documents and authoritative sources from industry standards, control frameworks and regulations.
• Work with the Global Methodology Program Lead to deliver the program's service offerings, strategy and objectives, and implement the PRC Framework operating model.
• Partner with Policy, Risk, Control and Compliance teams and global, cross-functional groups, including Information Security, Client and Enterprise Technology, Global and Enterprise Risk Management, Internal Audit and Legal.
• Contribute to the maturation of the IT PRC Framework and its alignment with GRC tooling, and assess emerging regulations and frameworks against the methodology to identify gaps.
• Map PRC common controls to Information Security policy and standard statements, and support gap assessments and control-to-policy mapping.
• Advise on the interpretation and use of the IT PRC Framework, create processes and procedures, and help manage the lifecycle of risk management documentation.
• Learn the Unified Compliance tool and support its use for assessments and control alignment.
• Help run education and awareness plans to build a risk-aware culture.

Required profile

• 2+ years of experience in IT, information security, security compliance, IT audit and/or IT risk management.
• Advanced degree in Computer Science, Information Security or a related field, or equivalent experience.
• Solid knowledge of GRC as applied to technology, and hands-on experience with ISO, NIST, COBIT, PCI DSS, GDPR, DORA, CRA and SOX.
• Experience on global and virtual teams; strong English, writing and presentation skills.
• Ideal candidates: IT risk management or information security experience, executive-level presentation skills, and certification such as CRISC, CISSP, CISM, CISA, CGRC, GIAC or Security+.

Required skills

• Knowledge of governance, risk and compliance models, industry standards and control frameworks.
• Ability to leverage automation for efficiency.
• Microsoft Office and M365 products, especially Word, Excel, PowerPoint, SharePoint, PowerApps, Power BI and Generative AI.