Analyst – vGRC (virtual Governance, Risk, and Compliance)

Tevora•Fairfax, VA

13d•Hybrid

About The Position

Tevora is seeking an Information Security Consultant with a balance of business acumen and technical expertise to support client information security programs. The role focuses on Governance, Risk, and Compliance (GRC), audit support, policy and procedure development, and advising clients on information security best practices. The position is available in Irvine, California, or Fairfax, Virginia; the posting specifically requires availability to work a hybrid schedule at the Irvine office. The analyst supports client GRC teams and audits, including SOX audits focused on IT general controls (ITGCs). The role also coordinates audit activities, leads or supports compliance and risk assessments, interviews clients to evaluate controls and identify recommendations, and contributes to information security documentation. Analysts manage multiple client engagements and communicate technical and process requirements to project stakeholders and cross-functional teams. Additional duties may be assigned.

Requirements

Direct experience with SOX ITGCs in an internal or external audit role.
Ability to communicate effectively with clients and colleagues across business and technical boundaries and provide recommendations based on best practices.
Ability to work independently, anticipate next steps, and solve problems without detailed guidance.
Ability to understand and predict customer and project needs.
Ability to balance multiple project timelines and prioritize differing client needs.
Proficiency in writing executive-level reports and technical documentation.
Comprehensive knowledge of common IT and security concepts and a strong desire to expand that knowledge.
At least one accounting, risk, or IT certification held or in process, such as CPA, CISSP, CISA, CISM, or CRISC.
Bachelor’s degree from an accredited four-year university.
At least 3 years of experience in information security, information technology, business consulting, enterprise risk, or compliance.
Direct experience with at least one compliance framework in addition to SOX: ISO 27001, SOC 2, SOC 1, or PCI-DSS.
Eligibility to work in the United States.
Availability to work a hybrid schedule at the Irvine, California office.

Nice To Haves

Demonstrated experience as an Information Security Compliance Auditor.
At least 2 years of experience in a client-facing role, such as consulting or external auditing.

Responsibilities

Support clients with GRC programs, audit support, policy and procedure development, and information security best practices.
Support successful completion of client SOX audits focused on ITGCs.
Coordinate and manage clients’ internal or external audits, including control compliance reviews, evidence collection, and coordination of audit work.
Lead or support compliance and risk assessments, including providing guidance to junior resources.
Conduct client interviews to analyze information security controls or risks and identify recommendations.
Execute multiple client engagements simultaneously.
Communicate requirements for technical and process improvements to project stakeholders.
Assist in developing customized policies, procedures, controls, disaster recovery plans, and other documentation for applications, systems, and infrastructure.
Work with cross-functional teams to provide information security compliance support and maintain communication across groups.
Perform additional duties as assigned.