Lead Security GRC Analyst

Job Summary

Lead Security GRC Analyst

We are seeking a highly motivated Cybersecurity GRC Specialist with 6-9 years of experience in Governance, Risk, Compliance, Privacy, and Information Security programs. The ideal candidate will have hands-on expertise in SOC 2 Type II, ISO 27001/27002, HITRUST CSF, HIPAA Security and Privacy requirements, and GDPR compliance. The role will be responsible for driving compliance initiatives, risk assessments, audit readiness, policy governance, privacy compliance, and continuous improvement of the organization s security and compliance posture.

Responsibilities

• Governance Compliance
  • Lead and support compliance programs aligned to SOC 2 Type II, ISO 27001/27002, HITRUST CSF, HIPAA Security and Privacy Rules, GDPR, and applicable global privacy regulations.
  • Conduct compliance gap assessments and maturity evaluations.
  • Develop, review, and maintain cybersecurity policies, standards, procedures, and guidelines.
  • Drive remediation efforts for audit findings and compliance gaps.
• Risk Management
  • Perform enterprise security risk assessments and third-party/vendor risk assessments.
  • Maintain risk registers and track mitigation activities through closure.
  • Facilitate risk treatment plans with business and technology stakeholders.
  • Support control design reviews and risk-based decision-making.
• Audit Certification Support
  • Coordinate internal and external audits and assessments.
  • Provide auditors with evidence, documentation, control narratives, and framework mappings.
  • Support certification and attestation activities for ISO 27001, HITRUST, and SOC 2 engagements.
  • Track audit observations, corrective actions, and management responses through closure.
• Privacy Regulatory Compliance
  • Support HIPAA Security and Privacy compliance initiatives.
  • Assist with GDPR obligations, including Data Protection Impact Assessments, privacy risk assessments, data retention and classification requirements, and third-party privacy reviews.
  • Partner with Legal, Privacy, Security, Technology, and business teams on regulatory and compliance matters.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.