Note: The job is a remote job and is open to candidates in USA. Golden Technology is seeking a Senior Information Security GRC Analyst to support and advance its information security governance, risk management, and compliance program. The role leads complex risk assessments, supports audits and regulatory or customer assurance activities, maintains GRC documentation, tracks remediation, and advises cross-functional stakeholders on security risk and compliance.
Responsibilities
- Lead and perform information security risk assessments for applications, infrastructure, business processes, suppliers, and new technology initiatives, including identification of threats, vulnerabilities, likelihood, impact, control effectiveness, residual risk, and recommended treatment options
- Maintain and update risk registers, issue logs, control gap trackers, audit findings, evidence repositories, policy exception records, and remediation plans to support accurate reporting and timely closure
- Support the development, review, maintenance, and communication of information security policies, standards, procedures, control documentation, and supporting governance materials
- Coordinate internal audits, external audits, regulatory reviews, customer security assessments, RFIs, due diligence questionnaires, and evidence requests by gathering documentation, validating responses, and tracking corrective actions
- Support compliance with applicable frameworks, standards, legal, regulatory, contractual, and customer requirements, including ISO/IEC 27001, NIST, COBIT, ITIL, ISO 31000, GDPR, and other applicable cybersecurity and privacy obligations
- Partner with application, infrastructure, security operations, privacy, legal, quality, procurement, internal audit, and business stakeholders to ensure security requirements are understood, implemented, and monitored
- Support third-party and supplier risk management activities, including security due diligence, questionnaire reviews, contract security input, risk documentation, remediation follow-up, and exception management
- Track remediation activities for security risks, audit findings, vulnerability findings, penetration testing results, control gaps, and compliance issues; follow up with owners and escalate overdue or high-risk items as appropriate
- Develop dashboards, metrics, management reports, and status updates that communicate risk posture, control effectiveness, audit readiness, compliance obligations, remediation progress, and emerging issues
- Support disaster recovery, business continuity, crisis management, and operational resilience activities through documentation, testing support, tabletop exercises, lessons learned, and improvement tracking
- Provide senior-level guidance to stakeholders on security risk management, control expectations, policy compliance, evidence requirements, and risk treatment decisions
- Monitor changes in information security laws, regulations, frameworks, threats, and industry best practices; recommend updates to policies, controls, procedures, and reporting practices as needed
- Support continuous improvement of GRC processes, including automation, workflow optimization, evidence management, reporting enhancements, and adoption of GRC or Integrated Risk Management tooling
- Promote a strong security and compliance culture through stakeholder engagement, awareness support, clear communication, and practical guidance
- Maintain confidentiality of company, customer, employee, and supplier information and comply with all Information Security standards, procedures, and ethical requirements
Skills
- • Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, Business, Risk Management, or a related field, or equivalent professional experience
- • 5+ years of experience in information security, cybersecurity risk management, IT audit, compliance, governance, or a related GRC role
- • Experience performing information security risk assessments, control reviews, audit support, compliance assessments, and remediation tracking
- • Strong working knowledge of information security and risk management frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework, NIST 800-53, ISO 31000, COBIT, ITIL, and related control frameworks
- • Familiarity with privacy, regulatory, contractual, and customer assurance requirements such as GDPR, SOC 2, and other applicable obligations
- • Experience supporting customer security questionnaires, RFIs, supplier risk assessments, policy governance, audit evidence collection, and risk reporting
- • Strong understanding of cybersecurity principles, risk management practices, compliance programs, control design, control testing, and audit readiness
- • Ability to assess risk severity and business impact using multiple sources of information, including assessment results, audit findings, vulnerability data, business context, and control effectiveness
- • Excellent written and verbal communication skills, with the ability to explain technical, risk, and compliance topics to both technical and non-technical stakeholders
- • Strong analytical, problem-solving, prioritization, and decision-making capabilities
- • Ability to manage multiple assignments, deadlines, stakeholders, and competing priorities with limited supervision
- • Demonstrated ability to influence stakeholders, drive accountability, and support timely remediation of risks and control gaps
- • Strong attention to detail and ability to produce clear, accurate, and audit-ready documentation
- • Commitment to delivering practical, business-aligned security guidance and high-quality stakeholder service
- • Experience with GRC, Integrated Risk Management, ticketing, workflow, dashboarding, or evidence management tools is preferred
- • Professional certifications such as CISA, CISM, CISSP, CRISC, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, or equivalent are preferred
Benefits
- Remote, hybrid, or office-based work as assigned
Company Overview
Company H1B Sponsorship