Information Security GRC Analyst

Barnes & Thornburg LLP•Philadelphia, PA

About The Position

As a member of the Information Security team, the Information Security GRC Analyst supports the firm’s technology risk management policies, procedures, and guidelines. The role helps ensure technology risks are measured, prioritized, and appropriately maintained in the risk register. Working under the direction of the Information Security Governance Manager, the Analyst helps analyze, document, and track risks related to business operations and supports the monitoring and improvement of risk management processes. The position supports risk assessments, security policy and documentation management, third-party risk management, ISO 27001 ISMS operations, security awareness, and responses to client and external security assessments. It also assists with operating the ISMS and PIMS in alignment with ISO 27001:2022 and ISO 27701:2019. Other information security duties may be assigned. The employee must be able to perform the essential duties satisfactorily, with or without reasonable accommodation. The work is performed in a normal office environment with little exposure to excessive noise, dust, temperature, and similar conditions. Specific work hours will be assigned and are generally during core business hours, though requirements may vary occasionally according to firm needs. Duties and responsibilities may change temporarily or permanently, with or without notice.

Requirements

Bachelor’s degree or equivalent experience.
Two years of relevant experience in IT, Risk Management, or Information Security; internships or academic coursework may be considered.
Familiarity with IT risk and threat assessment methodologies.
Exposure to or familiarity with security governance, compliance, or control frameworks, including the ISO 27000 series and SOC 2 Type II.
Familiarity with IT security policies, procedures, and standards.
Technical knowledge in at least one area such as IT infrastructure, systems engineering, networking, or application development.
Familiarity with operating systems, application architectures, and security technologies.
Working knowledge of network and security protocols, including TCP/IP, SMTP, FTP, SSH, TLS, SSL, HTTP, IPSec, and other VPN protocols.
Basic understanding of IT concepts such as networks, systems, and databases, as well as foundational cybersecurity principles such as risk management, threat management, and vulnerability assessments.
Strong proficiency in Microsoft Office Suite (Excel, PowerPoint, Word, and Outlook), including advanced Excel skills for data analysis, tracking, and reporting.
Ability to work in a fast-paced and demanding environment, respond to shifting priorities, and meet deadlines.
Excellent oral and written communication skills, including the ability to articulate issues and information accurately, clearly, and succinctly.
Strong analytical and problem-solving abilities to address complex questions and issues.
Strong organizational skills and attention to detail, with accuracy, issue-tracking, follow-up, and resolution skills.
Ability to maintain confidentiality and discretion with sensitive information.
Ability to work collaboratively and, with guidance, independently; eagerness to learn and develop GRC skills.
Ability to perform essential job duties satisfactorily, with or without reasonable accommodation.

Nice To Haves

Entry-level security or IT certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or similar.
Interest in pursuing advanced certifications such as CISSP or CISA.
Familiarity with project management tools such as Microsoft Project, Asana, or Trello.

Responsibilities

Serve as a point of contact for IT and non-IT stakeholders on technology-related risk questions, escalating issues to senior team members and management as appropriate.
Support risk assessments, security policy and documentation management, third-party risk management, and ISO 27001 ISMS operations.
Help identify and assess technology-related risks and maintain the Information Security Risk Register.
Assist with periodic risk reporting to executive management and document management’s responses to identified risks.
Assist with IT Risk Assessments for on-premises and cloud-based infrastructure, platforms, applications, and key technology services in line with the IT Risk Management Methodology.
Help assess risks associated with major IT changes and technology implementations.
Track and process exceptions and waivers related to internal security standards, unapproved software, web/email content filtering, password policies, and similar matters.
Work with IT Infrastructure to help integrate security controls into Business Continuity/Disaster Recovery planning and ensure continuity of security controls where applicable.
Assist with operation of the Information Security Management System (ISMS) and Privacy Information Management System (PIMS) in alignment with ISO 27001:2022 and ISO 27701:2019.
Track and maintain security control requirements from ISO 27001 annex controls, client requirements, legal/regulatory guidelines, and other relevant frameworks.
Assist in responding to security audits, questionnaires, and assessments from clients and external parties, and support marketing and procurement teams with security-related content for client RFPs and vendor agreements.
Help analyze business and IT processes from an information security perspective and identify potential improvements.
Review policies and procedures to help ensure security control requirements are adequately covered, suggesting updates and improvements as necessary.
Support periodic review and updates of security policies in accordance with firm guidelines.
Support the Security Awareness Program, including planning and curriculum development.
Assist with security training content creation and delivery schedules for broad and targeted audiences.
Monitor and report participation in the awareness program and help address compliance issues.
Assist with periodic assessments of IT vendor relationships and help ensure third-party risk management issues are resolved and tracked.
Assist with security reviews of vendor agreements in coordination with Procurement and Legal.
Perform other information security duties as assigned.