This position will be fully remote and can be hired anywhere in the continental U.S.
Overview
- The GRC Analyst delivers recurring governance, risk, and compliance operational support within a managed-services environment.
- The role performs access reporting, account reconciliation, activity and audit-trail review, evidence handling, compliance tracking, audit support, and GRC and third-party risk workflow administration using approved systems, procedures, and review criteria.
- This is a client-dedicated role assigned to support designated managed-services clients and their defined GRC service requirements.
- The role works in client-owned or client-approved systems during applicable client-aligned service windows established for assigned engagements.
- This is an operational GRC delivery role accountable for accurate, timely, and traceable execution of assigned activities.
- The analyst supports control owners, risk owners, auditors, and service leadership while escalating exceptions and decisions outside assigned authority.
How you’ll make an impact
Access, Account & Permissions Governance
- Generate user access and permissions reports using approved systems, report parameters, and procedures.
- Reconcile non-user and inactive accounts across in-scope systems; document discrepancies and route exceptions for review and resolution.
- Maintain records related to staffing, assigned duties, access, and changes that affect required access or control reviews.
- Support elevated-access reviews and exception handling by collecting records, maintaining status, updating approved risk register or exception records, and escalating unresolved items.
System Activity, Audit Trail & Evidence Review
- Review system activity logs and audit trails according to defined review criteria and schedules; document the review performed and route identified exceptions.
- Archive, organize, and review security- and audit-related email reports and associated records in approved repositories.
- Check assigned evidence for completeness, accuracy, applicable period, source, and retrievability before routing it for review.
- Maintain traceable records of source, review status, disposition, owner, exception, escalation, and completion date.
Compliance & Audit Support
- Complete compliance forms, review trackers, attestations, and supporting records using approved source information.
- Assist in preparing audit reports and supporting evidence needed for regulatory and other assigned reviews.
- Perform accuracy, completeness, consistency, and traceability checks before routing deliverables for review or submission.
- Respond to assigned evidence or information requests within established priorities; document completion, dependencies, and exceptions.
GRC & Third-Party Risk Workflow Support
- Manage report queues and request tracking for GRC and third-party risk workflows using approved systems and procedures.
- Record request scope, ownership, status, due dates, dependencies, disposition, and supporting documentation accurately and consistently.
- Monitor aging items, follow up for missing information, and escalate blockers, overdue requests, or matters outside assigned authority.
- Coordinate with stakeholders to clarify requests and support timely completion without independently performing a third-party risk assessment, approving a third party, or accepting risk unless specifically delegated.
Service Delivery, Quality & Information Handling
- Perform assigned work using client-owned or client-approved systems and platforms during applicable client-aligned service windows.
- Follow approved procedures, access restrictions, data-handling requirements, naming conventions, and evidence-retention practices.
- Protect confidential, security-sensitive, employee, and access-related information and immediately escalate suspected handling or access issues.
- Prepare status and operational metrics for assigned work, including timeliness, aging, completion, exceptions, and quality.
- Identify recurring process or data-quality issues and recommend procedure clarifications without changing approved controls or processes without authorization.
Decision Authority & Accountability
- Execute assigned GRC activities within documented procedures, approved