GRC Analyst | Remote, USA

Optiv • Leawood, KS

1d • Remote

About The Position

The GRC Analyst delivers recurring governance, risk, and compliance operational support in a managed-services environment. This client-dedicated role supports designated clients and their defined GRC service requirements, working in client-owned or client-approved systems during service windows established for assigned engagements. The analyst is accountable for accurate, timely, and traceable execution of assigned activities and supports control owners, risk owners, auditors, and service leadership, escalating exceptions and decisions outside their authority.

The work includes access and permissions reporting, account reconciliation, elevated-access review support, system activity and audit-trail review, evidence handling, compliance tracking, audit support, and GRC and third-party risk workflow administration. The analyst follows approved systems, procedures, review criteria, access restrictions, data-handling requirements, and evidence-retention practices. This is an operational delivery role; the analyst does not independently approve access or third parties, accept risk, interpret legal or regulatory requirements, design controls, determine control effectiveness, approve control exceptions, or make material process changes unless specifically delegated.

The position is fully remote and may be hired anywhere in the continental United States.

Requirements

• At least 2 years of relevant experience in GRC, audit support, access governance, compliance operations, cybersecurity, risk management, third-party risk operations, or a related control function.
• Working knowledge of access governance, account status and ownership, elevated access, exception handling, evidence quality, record retention, and escalation practices.
• Familiarity with foundational audit and compliance concepts, including source evidence, review criteria, populations, findings, management responses, and remediation records.
• Ability to review structured records, reconcile data across systems, identify discrepancies, maintain evidence, and follow defined procedures.
• Proficiency with spreadsheet analysis and reporting, including filtering, lookups, reconciliation, and pivot tables.
• Experience with workflow systems, email-based reports, and document repositories.
• Ability to manage recurring and request-driven work, meet deadlines, maintain accurate trackers, and promptly escalate exceptions.
• Ability to handle confidential and security-sensitive information with discretion and comply with applicable access, privacy, and data-handling requirements.
• Ability to communicate clearly with technical and nontechnical stakeholders and document work so that it is reviewable and auditable.
• Bachelor’s degree in cybersecurity, information systems, risk management, business, or a related field, or an equivalent combination of education, training, certifications, military service, and relevant practical experience.

Nice To Haves

• Experience with access reporting, elevated-access reviews, inactive-account reconciliation, review trackers, evidence repositories, and exception records.
• Experience preparing audit evidence, compliance reports, or regulatory support materials under established review criteria.
• Experience supporting GRC or third-party risk workflows in a managed-services environment.
• Experience with spreadsheet, workflow, document-repository, GRC, or identity-governance platforms.
• Familiarity with recognized frameworks or assurance models such as NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001, SOC 2, or applicable regulatory requirements.
• Relevant training or certification such as Security+, CISA, CRISC, CGRC, or comparable coursework.

Responsibilities

• Generate user access and permissions reports using approved systems, report parameters, and procedures.
• Reconcile non-user and inactive accounts across in-scope systems, document discrepancies, and route exceptions for review and resolution.
• Maintain staffing, assigned-duty, access, and change records relevant to access or control reviews.
• Support elevated-access reviews and exception handling by collecting records, maintaining status, updating approved risk register or exception records, and escalating unresolved items.
• Review system activity logs and audit trails according to defined criteria and schedules, document reviews, and route identified exceptions.
• Archive, organize, and review security- and audit-related email reports and records in approved repositories.
• Check assigned evidence for completeness, accuracy, applicable period, source, and retrievability before routing it for review.
• Maintain traceable records of source, review status, disposition, owner, exception, escalation, and completion date.
• Complete compliance forms, review trackers, attestations, and supporting records using approved source information.
• Assist in preparing audit reports and supporting evidence for regulatory and other assigned reviews.
• Perform accuracy, completeness, consistency, and traceability checks before routing deliverables for review or submission.
• Respond to assigned evidence or information requests within established priorities and document completion, dependencies, and exceptions.
• Manage report queues and request tracking for GRC and third-party risk workflows using approved systems and procedures.
• Record request scope, ownership, status, due dates, dependencies, disposition, and supporting documentation accurately and consistently.
• Monitor aging items, follow up for missing information, and escalate blockers, overdue requests, or matters outside assigned authority.
• Coordinate with stakeholders to clarify requests and support timely completion without independently performing third-party risk assessments, approving third parties, or accepting risk unless specifically delegated.
• Perform assigned work in client-owned or client-approved systems and platforms during applicable client-aligned service windows.
• Follow approved procedures, access restrictions, data-handling requirements, naming conventions, and evidence-retention practices.
• Protect confidential, security-sensitive, employee, and access-related information and immediately escalate suspected handling or access issues.
• Prepare status and operational metrics for assigned work, including timeliness, aging, completion, exceptions, and quality.
• Identify recurring process or data-quality issues and recommend procedure clarifications without changing approved controls or processes without authorization.
• Execute assigned GRC activities within documented procedures, approved access, defined review criteria, and established service priorities.
• Make routine record-maintenance, queue-management, and evidence-organization decisions in accordance with approved standards.
• Escalate suspected control failures, anomalous activity, unresolved reconciliation issues, missing audit evidence, access concerns, overdue work, and decisions outside assigned authority.

Benefits

• Employee Resource Groups and a commitment to inclusion.
• Work/life balance.
• Professional training resources.
• Creative problem-solving and the ability to tackle unique, complex projects.
• Volunteer opportunities through Optiv Chips In.
• The ability and technology necessary to productively work remotely/from home, where applicable.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level