IT Governance, Risk & Compliance Analyst I

Key Job Accountabilities

• Compliance Assessment: Assist in conducting internal security reviews and readiness assessments to measure compliance with industry frameworks (e.g., NIST CSF, ISO/IEC 27001, CIS COBIT, CIS Controls) and industry regulations (e.g., SOX, SEC, GDPR, HIPAA).
• Risk Register & Evidence Management: Assist in identifying and documenting IT risks within the Risk Register; serve as a primary coordinator for the collection, organization, and initial quality review of evidence for internal and external audits.
• Control Execution & Monitoring: Support the design of IT controls and execute control tests; proactively track and follow up with stakeholders to ensure the timely completion of evidence submission and control performance.
• Policy Support: Assist in drafting, reviewing, and proposing updates to IT policies, standards, and procedures to ensure documentation remains current and aligned with industry best practices and regulatory changes.
• Third-Party Risk Management (TPRM): Participates in and supports the GRM team in completing security questionnaires from prospective vendors and assists in evaluating the security posture of third-party partnerships against organizational standards.
• All GT team members are responsible for upholding the organization's cybersecurity posture by adhering to security policies and procedures, actively participating in training, protecting data and systems, actively identifying and mitigating vulnerabilities, and promptly reporting any suspicious activity or potential security incidents.

Education/Experience Qualifications

• Bachelor's Degree with 1 or more years of related experience is preferred. An equivalent combination of education and/or experience will be considered.
• Industry recognized certifications such as the CompTIA Security+ or the CISA are not required, but preferred.

Other Qualifications

• Foundational knowledge of industry-standard security frameworks (e.g., NIST CSF, ISO 27001, or CIS Controls) and their application in building a corporate security program is required.
• Basic understanding of core security technologies (e.g., EDR, DLP, SIEM, and Vulnerability Management) and their role in validating control effectiveness and maintaining regulatory compliance is required.
• Ability to translate technical security data into clear, concise documentation and reports for non-technical stakeholders is required.
• Proficiency in spreadsheet software (e.g. Google Sheets, Microsoft Excel) for tracking compliance metrics and generating reports is required.
• Basic grasp of enterprise IT architecture-including cloud environments (GCP/AWS/Azure), networking, and database management-with the ability to identify where security controls are necessary to mitigate risk is preferred.
• Familiarity with Google Cloud, AWS, or Azure cloud security concepts is preferred.
• Experience in technical support or help desk work, preferably in a manufacturing setting, is preferred.

Additional information

This document does not represent a contract of employment and is not intended to capture every possible assignment the incumbent could be asked to perform.

If you need an application accommodation, please contact us by email at. Please include your contact information and clearly describe how we can help you. This email is for accommodation requests only and cannot be used to inquire about the status of applications.

Some offers of employment are contingent upon successfully passing a drug screen and/or background check.