Information Security Analyst – GRC

We are seeking an experienced IT Compliance and Security Analyst with strong expertise in the information security domain. The successful candidate will be responsible for managing compliance and security-related inquiries from both internal teams and external customers. This role involves reviewing each request carefully, preparing accurate and policy-supported responses, obtaining approval from the Chief Information Security Officer (CISO), and communicating the approved information to the requester in a timely manner.

Key Responsibilities

- Receive and review compliance and security queries from internal stakeholders and external customers concerning documents, policies, and services.
- Utilize your information security knowledge to assess each query and ensure that responses accurately reflect the organization’s security controls and practices.
- Conduct thorough research to identify relevant policies, procedures, certifications, and supporting evidence for each inquiry.
- Draft clear, precise, and professional responses, including security questionnaires, due diligence requests, and audit-related queries.
- Share approved responses and documentation with requesters within agreed timelines to maintain transparency and trust.
- Maintain an organized tracker of incoming requests, including their status, approvals, and turnaround times to ensure efficient workflow management.
- Keep security and compliance documentation well-organized, version-controlled, and up to date to support audit readiness and internal reviews.
- Collaborate with IT, Legal, HR, and other departments to gather necessary information and evidence for compliance purposes.
- Support internal and external audits, assessments, and control reviews by providing required documentation and clarifications.
- Identify recurring queries and contribute to building a library of standard, pre-approved responses to streamline future communications.

Required Qualifications

- Bachelor’s degree in Information Security, Computer Science, Information Technology, or a related field.
- 3 to 5 years of experience in IT compliance, information security compliance, Governance, Risk, and Compliance (GRC), or security assurance.
- Strong knowledge and hands-on experience in information security, including security policies, risk management, security controls, and best practices.
- Familiarity with major frameworks and standards such as ISO 27001, SOC 2, NIST, and GDPR.
- Understanding of general IT controls, including access management, change management, backup and disaster recovery, and vulnerability management.
- Experience in completing customer security questionnaires and supporting audit processes.
- Excellent written communication skills with the ability to explain complex technical and compliance topics clearly and concisely.
- Strong attention to detail and good document control practices to ensure accuracy and compliance.
- Ability to manage multiple requests simultaneously and meet strict deadlines.
- Relevant certifications such as ISO 27001 Lead Implementer or Lead Auditor, Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), or Security+ are highly desirable.
- Experience working with international or enterprise clients is preferred.

This role offers the opportunity to work in a dynamic environment where your expertise in information security compliance will directly contribute to maintaining the organization’s security posture and customer trust. If you have a passion for security and compliance and enjoy collaborating across teams to solve complex challenges, this position is an excellent fit.