GRC Analyst I, SOC 2 (Platform)

Sensiba

8d•Remote

About The Position

The GRC Analyst I supports clients undergoing SOC 2, ISO 27001, and related cybersecurity compliance assessments. This role focuses on evaluating security controls within cloud-based and technology-driven environments, including infrastructure, applications, software development practices, and information security programs. The ideal candidate possesses a foundational understanding of cybersecurity concepts, cloud technologies, and technology risk management. They are interested in helping innovative technology companies strengthen their control environments while developing expertise in cybersecurity assurance and compliance.

Requirements

Foundational knowledge of: Cloud computing, Networking, Cybersecurity principles, Information security controls.
Strong written and verbal communication skills.
Strong analytical and problem-solving abilities.
Ability to manage multiple priorities and deadlines.
Familiarity with: AWS, Azure, or GCP, SIEM solutions, Vulnerability management solutions, Security operations concepts.

Nice To Haves

Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Systems, or related field.

Responsibilities

Assist in the execution of SOC 2 examinations, readiness assessments, and other cybersecurity compliance engagements.
Observe, document, and test controls related to: Identity and Access Management (IAM), Change Management, Vulnerability Management, Incident Response, Security Monitoring, Backup and Recovery, Vendor Management, Risk Management.
Review and evaluate security policies, standards, and procedures.
Assess the design and operating effectiveness of IT and security controls.
Perform testing of logical access controls across cloud and business applications.
Document client control environments and supporting evidence.
Develop an understanding of client technology environments, including: AWS, Azure, Google Cloud Platform (GCP), SaaS applications, Infrastructure and networking concepts.
Review software development lifecycle (SDLC) processes and change management controls.
Evaluate cloud security controls and supporting configurations.
Assist with documenting system architecture, data flows, and integrations.
Build and maintain strong client relationships.
Communicate findings and recommendations clearly and professionally.
Participate in client meetings and walkthroughs.
Support clients in understanding remediation opportunities and compliance expectations.