Copy-ready job description
Edit the bracketed fields for your requirement.
GRC Analyst
About the role
We are looking for a GRC Analyst to join our team. You will assess controls against frameworks such as NIST, ISO 27001 and SOC 2.
Responsibilities
- Assess controls against frameworks such as NIST, ISO 27001 and SOC 2.
- Maintain risk registers and track remediation.
- Support audits and evidence collection.
- Write and update policies and procedures.
- Report risk to stakeholders.
Required
- Frameworks (NIST, ISO 27001, SOC 2)
- Risk assessments
- Audit support
- Policy writing
- GRC tools (Archer, ServiceNow GRC)
Preferred
- CISA or CISSP
- PCI-DSS
- HIPAA
- Third-party risk
Tools and stack
GRC platforms, Risk registers, Evidence tools, NIST and ISO 27001, SOC 2 reports, Spreadsheets and ticketing
Employment type: [Contract / W2 / C2C / Full-time]
Location: [City, ST / Remote]
Duration: [months]
Work authorization: [accepted types]Responsibilities explained
Each responsibility maps to something a candidate should be able to describe.
- Assess controls against frameworks such as NIST, ISO 27001 and SOC 2.
- Maintain risk registers and track remediation.
- Support audits and evidence collection.
- Write and update policies and procedures.
- Report risk to stakeholders.
Required skills
Treat these as the screen. If a candidate cannot speak to them, they are rarely a fit.
- Frameworks (NIST, ISO 27001, SOC 2)
- Risk assessments
- Audit support
- Policy writing
- GRC tools (Archer, ServiceNow GRC)
Preferred skills
Use these to rank candidates who meet the required list.
- CISA or CISSP
- PCI-DSS
- HIPAA
- Third-party risk
Other titles this role appears under
Search and post under the variants your clients use.
- GRC Analyst
- IT Risk Analyst
- Compliance Analyst
- Security Compliance Analyst
Seniority guide
Pick the level you need and state it plainly in the posting.
- Junior: collects evidence and updates registers.
- Mid: runs assessments for a framework.
- Senior: designs the compliance program.
Tailoring a resume to this description
When you submit a consultant, mirror the required skills and tools in the summary and the most recent role, using only experience the candidate really has. MatchWire’s resume tailoring drafts this from the candidate’s stored work history and the posting.
Frequently asked questions
How long should a job description be?
Long enough to list the responsibilities, required and preferred skills, tools and logistics, usually 300 to 500 words.
Should I list a rate in the description?
If the client allows it, a range helps candidates self-select. Otherwise state it as “rate to be discussed” and confirm it before submitting.