Analyst – vGRC (virtual Governance, Risk, and Compliance)

Tevora•Irvine, CA

18d•$94,500 - $105,000•Hybrid

About The Position

Tevora is seeking an Information Security Consultant with a balance of business acumen and technical expertise. The analyst consultant supports clients with Governance, Risk, and Compliance (GRC) programs, audit support, policy and procedure development, and information security best practices. The role includes supporting SOX audits focused on ITGCs, coordinating internal and external audits, and leading or supporting compliance and risk assessments. The analyst works across multiple client engagements, communicates technical and process requirements to stakeholders, and helps develop tailored information security documentation for applications, systems, and infrastructure. The position requires working independently, anticipating client and project needs, balancing timelines, and communicating effectively across business and technical teams. The role is hybrid and requires availability to work at Tevora’s Irvine, California office, as well as eligibility to work in the United States.

Requirements

Direct experience with SOX ITGCs in an external or internal audit role.
Ability to communicate effectively with clients and colleagues across business and technical boundaries and offer recommendations based on best practices.
Ability to work independently without detailed guidance, anticipate next steps, and solve problems.
Ability to understand and anticipate customer and project needs.
Ability to balance multiple project timelines and prioritize differing client needs.
Proficiency in writing executive-level reports and technical documentation.
Comprehensive knowledge of common IT and security concepts, with a strong desire to expand knowledge.
At least one accounting, risk, or IT certification held or in progress, such as CPA, CISSP, CISA, CISM, or CRISC.
Bachelor’s degree from an accredited four-year university.
At least 3 years of experience in information security, information technology, business consulting, enterprise risk, or compliance.
Direct experience with at least one compliance framework in addition to SOX: ISO 27001, SOC 2, SOC 1, or PCI-DSS.
Eligibility to work in the United States.
Availability to work a hybrid schedule at the Irvine, California office.

Nice To Haves

Demonstrated experience as an Information Security Compliance Auditor.
At least 2 years of experience in a client-facing role, such as consulting or external auditing.

Responsibilities

Support clients with GRC programs, audit support, policy and procedure development, and information security best practices.
Drive successful completion of SOX audits as part of a client’s GRC team, with a focus on ITGCs.
Coordinate and manage client internal or external audits, including control compliance reviews, evidence collection, and audit work coordination.
Lead or support compliance and risk assessments, including providing guidance to junior resources.
Interview clients to analyze information security controls or risk and identify recommendations.
Execute multiple client engagements simultaneously.
Communicate requirements for technical and process improvements to project stakeholders.
Assist in developing customized policies, procedures, controls, disaster recovery plans, and other documentation for applications, systems, and infrastructure.
Work with cross-functional teams to provide information security compliance support and maintain communication across groups.
Perform additional duties as assigned.