Information Security GRC Analyst

Cynet Systems•Frankfort, KY

About The Position

The Information Security GRC Analyst develops and maintains information security policies, standards, and procedures, and manages or supports the organization’s responses to security audits, assessments, and compliance inquiries. The role focuses on governance, risk, and compliance, applying information security governance principles and regulatory frameworks such as NIST, ISO 27001, SOC 2, and HIPAA. It requires clear communication with technical and non-technical stakeholders. The analyst works with internal teams and external auditors, supports risk assessments and control gap analysis, tracks remediation, maintains compliance documentation, and contributes to staff security awareness. The position also coordinates security scans and reviews findings, application security practices, CI/CD configurations, and secrets management for security-control and policy compliance.

Requirements

4–7 years of experience in information security, GRC, or audit/compliance support.
Familiarity with standards such as NIST 800-53, ISO 27001, SOC 2, HIPAA, PCI-DSS, or GDPR.
Strong writing skills and the ability to create clear, concise policies.
Experience participating in security audits and assembling evidence packages.
Excellent organizational, communication, and collaboration skills.
Strong verbal and written communication skills, including the ability to communicate with technical experts and executive management.
Bachelor’s degree with a focus in IT, or an equivalent combination of experience and knowledge.
Knowledge of and experience with Agile processes.
Strong analytical, design, and problem-solving skills.
Ability to work independently, demonstrate self-reliance, and show initiative with minimum supervision.
Ability to quickly learn new technologies and apply them appropriately to business situations.
Ability to work as a team player in a fast-paced team environment.
Ability to work under pressure and meet strict deadlines.
Ability to listen effectively and seek clarification.
Ability to build rapport with stakeholders.

Nice To Haves

Bachelor’s degree in Cybersecurity, Information Systems, or a related field.
Certifications such as CISSP, CISA, CISM, ISO 27001 Lead Implementer, or Security+.
Knowledge and understanding of the OWASP Top 10.
Knowledge and understanding of API security, including OAuth2 and OpenID Connect.
Knowledge and understanding of container security.
Ability to review CI/CD pipeline configurations, including Jenkins, GitHub Actions, and Azure DevOps, for security-control compliance.
Ability to review secrets management practices, including HashiCorp Vault and AWS Secrets Manager, for policy compliance.
Understanding of application-layer threats and controls.

Responsibilities

Develop, review, and update security policies, procedures, and standards in alignment with regulatory and industry frameworks such as NIST, ISO 27001, and CIS.
Collaborate with IT, Legal, HR, and the central technology office to ensure policies are practical, understood, and enforced.
Track policy lifecycle and version control.
Lead or assist with responses to third-party audits, internal audits, and customer security questionnaires.
Gather and organize documentation, evidence, and technical input to support audits.
Work with external auditors during SOC 2, ISO 27001, or other compliance assessments.
Support risk assessments and control gap analysis across business units.
Participate in implementing and tracking corrective actions or remediation plans.
Maintain documentation for risk management and compliance reporting.
Help develop and deliver security awareness training focused on policy adherence and compliance readiness.
Promote a culture of security and compliance across the organization.
Coordinate with internal IT to schedule penetration testing, vulnerability scans, and other security scans; review, interpret, and respond to findings.
Review CI/CD pipeline configurations for security-control compliance.
Review secrets management practices for policy compliance.