Information Security GRC Analyst

JD - Security/GRC

Role Overview

We are seeking a hands-on, highly technical Senior Security Analyst to bridge technical security operations and practical Governance, Risk, and Compliance (GRC). This role is ideal for a seasoned practitioner who thrives on execution , someone who prefers digging into telemetry, executing precise eDiscovery queries, evaluating third-party software risks, and driving patch remediation over sitting in high-level strategy meetings.

You will serve as the primary technical anchor for day-to-day security alerts, endpoint hygiene, cloud posture, and software vetting, while owning key data governance workflows across Microsoft 365 and Google Workspace envirienmfents.

Key Responsibilities

Data Governance, eDiscovery & GRC Operations

• Direct and perform technical search, export, preservation, and redaction workflows across Microsoft 365 (Purview) and Google Workspace Vault for legal hold, compliance, and privacy requests.
• Implement and monitor Data Loss Prevention (DLP) rules, sensitive data tags, and access controls to prevent unauthorized exposure of confidential data and PII.
• Partner with the Security Manager during internal and external compliance audits by extracting, validating, and presenting technical control evidence across cloud, endpoint, and identity systems.

Security Operations & Vulnerability Management

• Monitor and investigate security alerts across Microsoft Defender XDR, endpoints, identities, and cloud workloads, driving incident resolution through to root-cause post-mortems.
• Own routine vulnerability scanning via Tenable.io, working directly with IT/Infrastructure teams to enforce remediation SLAs and track exposure metrics.
• Oversee endpoint configuration compliance and patch deployment across Windows, macOS, and Linux using Microsoft Intune and Quest KACE SMA.
• Continuously audit Azure and AWS environments against CIS Benchmarks and internal hardening standards, remediating misconfigurations directly.
• Build and maintain practical automated playbooks and scripts to streamline routine alert triage and repetitive administrative security tasks.

Software & Emerging Tech Vetting

• Perform practical security vetting of all requested third-party software, SaaS applications, and API integrations, reviewing vendor SOC 2/ISO reports, permissions, and data handling practices before deployment.
  
• Evaluate third-party AI platforms, browser extensions, and agentic integrations to establish data privacy guardrails and mitigate shadow AI risks.

Technical Qualifications & Experience

• Bachelors degree in Computer Science, Cybersecurity, IT, or equivalent hands-on professional experience.
• 5+ years of hands-on experience in security administration, incident response, and technical GRC operations.
• Direct experience using Microsoft Purview and Google Workspace Vault for data holds, searches, and exports.
• Proficiency with Microsoft Defender XDR (or equivalent enterprise EDR/XDR suites) and log analysis.
• Hands-on experience with Tenable.io, Microsoft Intune, and endpoint management solutions (e.g., KACE).
• Technical familiarity with Azure security controls, CIS Benchmarks, and basic cloud identity models.
• Demonstrated ability to evaluate SaaS vendor security posture, architectural risk, and software permission scopes objectively.

Preferred / Desirable Certifications

• ISC2 SSCP, CompTIA CySA+, or Cisco CCNA/CCNP Security.
• Azure Security Engineer Associate (AZ-500) or Microsoft Security Operations Analyst (SC-200).
• ISACA CRISC, CISA, or practical risk assessment training.

#Extra/Internal Notes only

• Focused on practical output, procedural rigour, and technical troubleshooting rather than high-level slides or abstract theory.
• Capable of working directly with IT operations, legal teams, and business units to drive security hygiene without creating unnecessary friction.