GRC Analyst

This is a fully remote position, open to applicants in Kansas.

📋 Description

• Produce reports on user access and permissions utilizing authorized systems, report parameters, and established procedures.

• Reconcile non-user and inactive accounts within in-scope systems; document discrepancies and escalate exceptions as needed.

• Maintain documentation related to staffing, assigned responsibilities, access, and control reviews.

• Assist with elevated-access reviews and manage exception handling.

• Examine system activity logs and audit trails according to set criteria and schedules.

• Organize, archive, and evaluate security- and audit-related email reports and records.

• Verify assigned evidence for completeness, accuracy, applicable period, source, and retrievability.

• Keep traceable records of source, review status, disposition, owner, exception, escalation, and completion dates.

• Complete compliance forms, review trackers, attestations, and accompanying records.

• Support the preparation of audit reports and evidence for regulatory and assigned reviews.

• Conduct checks for accuracy, completeness, consistency, and traceability on deliverables.

• Address assigned evidence or information requests and document completion, dependencies, and exceptions.

• Oversee report queues and track requests for GRC and third-party risk workflows.

• Monitor aging items, follow up on missing information, and escalate blockers or overdue requests.

• Collaborate with stakeholders to clarify requests and ensure timely fulfillment.

• Execute assigned tasks using client-owned or client-approved systems during designated service windows.

• Adhere to procedures, access restrictions, data-handling guidelines, naming conventions, and evidence-retention practices.

• Safeguard confidential, security-sensitive, employee, and access-related information.

• Prepare status and operational metrics, including timeliness, aging, completion rates, exceptions, and quality.

• Identify recurring process or data-quality challenges and suggest clarifications to procedures.

• Report suspected control failures, unusual activity, unresolved reconciliation issues, missing audit evidence, access concerns, overdue tasks, and decisions beyond assigned authority.

⛳️ Requirements

• Minimum of 2 years' relevant experience in GRC, audit support, access governance, compliance operations, cybersecurity, risk management, third-party risk operations, or a related control function.

• Familiarity with access governance, account status and ownership, elevated access, exception handling, evidence quality, record retention, and escalation practices.

• Understanding of foundational audit and compliance concepts, including source evidence, review criteria, populations, findings, management responses, and remediation records.

• Capability to review structured records, reconcile data across systems, identify discrepancies, maintain evidence, and adhere to defined procedures.

• Proficient in spreadsheet analysis and reporting, including filtering, lookups, reconciliation, and pivot tables.

• Experience with workflow systems, email-based reports, and document repositories.

• Ability to manage recurring and request-driven tasks, meet deadlines, maintain accurate trackers, and escalate exceptions in a timely manner.

• Competence in handling confidential and security-sensitive information with discretion and complying with applicable access, privacy, and data-handling regulations.

• Skill in communicating clearly with both technical and non-technical stakeholders and documenting work for review and audit purposes.

• Bachelor’s degree in cybersecurity, information systems, risk management, business, or a related field, or an equivalent combination of education, training, certifications, military service, and relevant practical experience.

• Experience in access reporting, elevated-access reviews, inactive-account reconciliation, review trackers, evidence repositories, and exception records.

• Background in preparing audit evidence, compliance reports, or regulatory support materials under established review criteria.

• Experience supporting GRC or third-party risk workflows in a managed-services environment.

• Familiarity with spreadsheet, workflow, document-repository, GRC, or identity-governance platforms.

• Knowledge of NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001, SOC 2, or relevant regulatory requirements.

• Relevant training or certification such as Security+, CISA, CRISC, CGRC, or comparable coursework is preferred.

🏝️ Benefits

• A company dedicated to our inclusive values through Employee Resource Groups.

• Work/life balance.

• Access to professional training resources.

• Opportunities for creative problem-solving and tackling unique, complex projects.

• Volunteer opportunities through “Optiv Chips In.”

• The necessary technology and ability to work productively from home (where applicable).