Information Security GRC Analyst

Summary: As a member of the Information Security team, the Information Security GRC Analyst supports the firm’s technology risk management policies, procedures, and guidelines. This role helps ensure that technology risks are measured, prioritized, and appropriately maintained in the risk register. Working under the direction of the Information Security Governance Manager, the GRC Analyst will help analyze, document, and track risks related to business operations, and will support the monitoring and improvement of risk management processes.

Key Responsibilities

• Serve as a point of contact for IT and non-IT stakeholders on technology-related risk questions, escalating issues to senior team members and management as appropriate.
• Support other professionals in technology risk management, covering areas such as risk assessments, security policy and documentation management, third-party risk management, and ISO 27001 ISMS operations.
• Help identify and assess technology-related risks and maintain the Information Security Risk Register.
• Assist with periodic risk reporting to executive management, documenting management’s response to identified risks.
• Assist with IT Risk Assessments for on-premises and cloud-based infrastructure, platforms, applications, and key technology services, in line with IT Risk Management Methodology.
• Help assess the risks associated with major IT changes and technology implementations.
• Track and process exceptions and waivers related to internal security standards, unapproved software, web/email content filtering, password policies, etc.
• Work with IT Infrastructure to help ensure that security controls are integrated into Business Continuity/Disaster Recovery planning, ensuring the continuity of security controls where applicable.
• Assist with the operation of the Information Security Management System (ISMS) and Privacy Information Management System (PIMS) in alignment with ISO 27001:2022 and ISO 27701:2019 standards.
• Track and maintain security control requirements from various sources, including ISO 27001 annex controls, client requirements, legal/regulatory guidelines, and other relevant frameworks.
• Assist in responding to security audits, questionnaires, and assessments from clients and external parties, supporting marketing and procurement teams with security-related content for client RFPs and vendor agreements.
• Help analyze business and IT processes from an information security perspective and identify potential improvements.
• Review policies and procedures to help ensure security control requirements are adequately covered, suggesting updates and improvements as necessary.
• Support the periodic review and update of security policies in accordance with firm guidelines.
• Support the Security Awareness Program, including assisting with planning and curriculum development.
• Assist with content creation and delivery schedules for both broad and targeted security training.
• Monitor and report on participation in the awareness program, helping to address any compliance issues.
• Assist with periodic assessments of IT vendor relationships, helping ensure that third-party risk management issues are resolved and tracked.
• Assist with security reviews of vendor agreements in coordination with the Procurement and Legal teams.

Additional Responsibilities

• Perform other duties related to information security as assigned.

The employee must be able to perform all essential job duties and responsibilities of this position satisfactorily and as outlined, with or without reasonable accommodations. Reasonable accommodation requests may be accommodated, absent undue firm hardship.

Qualifications

• Bachelor’s degree or equivalent experience.
• 2 years of relevant experience in IT, Risk Management, or Information Security; internships or academic coursework may be considered.
• Entry-level security or IT certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or similar preferred; interest in pursuing advanced certifications such as CISSP or CISA.
• Familiarity with IT risk and threat assessment methodologies.
• Exposure to or familiarity with security governance, compliance, or control frameworks, including ISO 27000 series, SOC 2 Type II.
• Familiarity with IT security policies, procedures, and standards.
• Technical knowledge in at least one area such as IT infrastructure, systems engineering, networking, or application development.
• Familiarity with operating systems, application architectures, and security technologies.
• Working knowledge of network and security protocols, including TCP/IP, SMTP, FTP, SSH, TLS, SSL, HTTP, IPSec, and other VPN protocols.
• Basic understanding of IT concepts such as networks, systems and databases, as well as foundational cybersecurity principles (e.g. risk management, threat management, vulnerability assessments).
• Strong proficiency in Microsoft Office Suite (Excel, PowerPoint, Word, Outlook) with advanced skills in Excel for data analysis, tracking and reporting.
• Ability to work in a fast-paced and demanding environment and respond to shifting priorities while meeting deadlines.
• Excellent oral and written communication skills; must be able to articulate issues and information accurately, clearly and succinctly.
• Strong analytical and problem-solving abilities needed to address complex questions and issues.
• Must have strong organizational skills and be extremely detail-oriented; attention to detail, high-level of accuracy, issue-tracking, follow-up and resolution skills are essential.
• Ability to maintain confidentiality and discretion of sensitive information.
• Ability to work collaboratively and, with guidance, independently; eagerness to learn and develop GRC skills.
• Familiarity with project management tools (e.g. Microsoft Project, Asana, Trello) preferred.

Working Conditions

• Normal office environment with little exposure to excessive noise, dust, temperature and the like.
• Specific work hours for this position will be assigned; generally, core business hours. The requirements may vary occasionally, depending on the needs of the Firm.

The above is intended to describe the general content of and requirements for the performance of this job. It is not to be construed as an exhaustive statement of essential functions, responsibilities or requirements.Subject to firm needs, duties and responsibilities of this position may change at any time, on a temporary or permanent basis, and with or without notice.

Equal Employment and Opportunity Statement

Barnes & Thornburg is committed to equal employment opportunity in both principle and as a matter of policy. We will recruit, hire, train, promote, compensate and provide benefits to all applicants and employees without regard to ancestry, sex, race, color, ethnicity, national origin, gender, age, religion, religious creed, mental and/or physical disability, medical condition, military and/or veteran’s status, genetic information, marital status, sexual orientation, gender identity and/or expression, or any other basis protected by applicable federal, state and local laws. This policy applies to all recruiting, hiring, promotions, upgrades, layoffs, compensation, benefits, terminations and all other privileges, terms and conditions of employment. The firm complies fully with all federal, state and local equal employment opportunity laws.