GRC Analyst - Global Industrial

Genuine Parts Company•Atlanta, GA

About The Position

The Governance, Risk & Compliance (GRC) Analyst II supports Motion’s GRC functions, which may include Privacy, Compliance, Risk Management, Third-Party Risk, Governance, or Attack Surface Management. Under general supervision, the analyst executes day-to-day activities within an assigned domain and reports to the GRC Lead. The role includes vulnerability and external attack surface management; security policy and awareness program administration; governance, audit, compliance, and operational technology compliance support; privacy program operations; and IT and third-party risk assessment and remediation tracking. The analyst coordinates with internal teams, business partners, and vendors, and produces reporting and metrics for the GRC Lead.

Requirements

Typically requires a bachelor’s degree in computer science, software engineering, or a related field, and three to five years of related experience, or an equivalent combination.
Strong analytical, organizational, and documentation skills.
Excellent written and verbal communication skills.
Ability to work independently in a lean team environment.
Detail-oriented and self-directed.
Familiarity with GRC tooling or platforms.
Experience in a framework relevant to the assigned functional area.

Nice To Haves

Relevant certification or progress toward certification.

Responsibilities

Monitor vulnerability scanning results and maintain visibility into Motion’s external attack surface.
Track and prioritize vulnerabilities for remediation in partnership with IT Operations and Application Development.
Own vulnerability management reporting, metrics, and scanning tool administration.
Drive remediation service level agreements and escalate cross-team blockers as needed.
Develop, maintain, and periodically review information security policies and standards.
Own the IT Security Awareness program, including content updates and stakeholder participation tracking.
Manage policy exceptions and the exception and acceptance process.
Represent Governance in cross-team initiatives and audits.
Support compliance activities across pertinent platforms and operational technology (OT) compliance efforts in partnership with the Cyber Defense Engineering & Architecture team.
Manage privacy notices, cookie compliance, and consent and preference management across digital properties.
Support privacy program operations, including gap identification and remediation tracking.
Assist with Privacy Impact Assessments (PIAs) and Data Privacy Impact Assessments (DPIAs).
Manage intake and processing of Data Subject Access Requests (DSARs).
Assist with compliance audits and assessments, including evidence coordination.
Produce privacy and compliance metrics and reporting data for the Lead, and support development of privacy training and awareness content.
Maintain and update the cyber risk register and track security issues through remediation, following up with control owners on outstanding items.
Support execution of IT risk assessments and third-party/vendor risk assessments, including periodic reviews and quality assurance of risk documentation.
Track and communicate risk exceptions and remediation action plans to stakeholders.
Collaborate with business partners and vendor stakeholders to identify risk-process improvement opportunities.
Maintain awareness of relevant risk frameworks and standards.