GRC Analyst

Ametek, Inc. • Easttown Township, PA

7d

About The Position

The GRC Analyst leads and administers key components of the organization's IT Risk Management program. The role coordinates vulnerability risk tracking, exception management, and third-party risk assessments, partnering with Information Security, Infrastructure, Audit Services, Legal, Procurement, and business stakeholders to identify, assess, monitor, and report risks affecting operations, regulatory compliance, security posture, and strategic objectives.

The ideal candidate has strong analytical skills, knowledge of cybersecurity and risk management frameworks, and the ability to communicate risk to technical and non-technical stakeholders.

Requirements

• Bachelor's degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business Administration, or a related field.
• 3–7 years of experience in Governance, Risk & Compliance (GRC), Information Security, IT Audit, Risk Management, or Cybersecurity.
• Experience managing IT risk registers, exception management processes, and vulnerability governance programs.
• Experience conducting security and risk assessments for third-party vendors.
• Strong understanding of cybersecurity principles, security controls, and risk management methodologies.
• Experience preparing executive-level risk reporting and metrics.
• Strong written, verbal, and presentation communication skills.
• Ability to manage multiple priorities and work effectively across cross-functional teams.
• Legal right to work in the United States on a full-time basis without employer sponsorship now or in the future.

Nice To Haves

• Professional certifications such as CISA, CRISC, CISSP, or CISM.
• Working knowledge of frameworks such as NIST CSF, NIST RMF, ISO 27001, SOC 2, COBIT, PCI-DSS, and SOX.
• Experience with third-party risk platforms such as Bitsight.
• Experience with GRC platforms such as ServiceNow GRC, Vanta, IntelliGRC, OneTrust, or AuditBoard.

Responsibilities

• Administer and maintain the enterprise IT Risk Register.
• Facilitate risk identification, assessment, documentation, and mitigation across IT and business functions.
• Conduct qualitative and quantitative risk assessments to evaluate business impact and likelihood.
• Collaborate with risk owners to develop and track remediation and mitigation plans.
• Monitor risk treatment activities and report on risk status, trends, and exposure.
• Prepare risk reports and executive summaries for management and governance committees.
• Support enterprise risk management initiatives and align activities with organizational risk appetite and tolerance statements.
• Lead governance for vulnerability risk management processes, review assessment results, track remediation, and validate vulnerability closures.
• Coordinate with Security Operations to ensure vulnerabilities are remediated within established service level targets.
• Facilitate risk acceptance reviews when vulnerabilities cannot be remediated within required timelines.
• Develop metrics and reporting for vulnerability aging, remediation performance, and risk exposure; escalate critical vulnerabilities and overdue remediation as appropriate.
• Administer and maintain the IT Security Exception Register.
• Review exception requests for policies, security standards, or technical controls; facilitate associated risk assessments.
• Document compensating controls and residual risk evaluations, and coordinate approval workflows with risk owners, security leadership, and business stakeholders.
• Track exception expiration dates and conduct periodic reviews of business justification.
• Report on exception trends, concentrations, and emerging risk patterns.
• Lead cybersecurity assessments for vendors, suppliers, service providers, and business partners.
• Conduct third-party security reviews, including analysis of questionnaires, audit reports, certifications, and independent assessments.
• Review customer questionnaires in accordance with AMETEK policies and standards.
• Identify and document residual risks associated with third-party relationships.
• Collaborate with Procurement, Legal, Information Security, and business sponsors throughout the vendor lifecycle.
• Monitor remediation of vendor findings and risk treatment plans, and support ongoing vendor risk monitoring and reassessments.

What This Job Offers

• Job Type: Full-time