About the Role

The GRC analyst helps maintain A-LIGN’s management system as it relates to information security standards. In this role, you will be responsible for the coordination, maintenance, and improvement of A-LIGN’s corporate compliance program, including internal and external audits.

Reports to

Director of Compliance and Program Management

Pay Classification

Full-Time

Responsibilities 

• Support information security compliance programs across applicable frameworks, including SOC 2, ISO 27001, ISO 42001, FedRAMP, CMMC, and NIST 800-53/171
• Coordinate audit, assessment and testing activities with internal and external stakeholders
• Validate identified findings and nonconformities, manage remediation tracking, monitor resolution progress, and report status to stakeholders
• Review, update, and maintain information security documentation in accordance with applicable standards and organizational objectives
• Maintain and update the GRC platform (Optro) current with risk, control, and compliance data
• Assist with the implementation and ongoing management of data loss prevention (DLP) programs, including false positive identification, policy violations, incident monitoring and response coordination
• Support third-party risk management activities, including contractor oversight and vendor due diligence reviews
• Assist with client-issued security questionnaires and assessments
• Assist with risk management, vulnerability management, incident reviews, data disposal reviews, and BC/DR planning and testing
• Monitor and track employee completion of security training and awareness programs

Minimum Qualifications

EDUCATION

• Bachelor’s degree in management information systems, Information Security, Cybersecurity, Business or a related field or an equivalent combination of education and experience

EXPERIENCE

• At least 1 year of IT security, governance, risk, or compliance-related experience
• Knowledge of security and risk frameworks
  • Preferred knowledge of SOC 2, ISO 27001, ISO 42001, FedRAMP, CMMC, NIST 800-53, NIST 800-171
• Preferred: Knowledge of GRC tools (Optro, OneTrust, etc.)

CERTIFICATIONS         

• Preferred: CISA, CISM, Security+, CCSK, ISO Lead Auditor

SKILLS

• Ability to meet deadlines with a high degree of motivation
• Excellent critical thinking and problem-solving skills
• Strong communication and organizational skills
• Thrives in a fast-paced environment
• Ability to work individually as well as collaboratively

Benefits

• Healthcare, Dental, and Vision Benefits
• EAP - Employee Assistance Program
• Competitive Bonus Structure
• Home Office Reimbursement
• Technology Allowance
• Certification Reimbursement
• Public Transportation Card
• Multisport Card
• Personalized Career Coaching
• Generous Paid Time Off
• Paid Office Closure December 24-January 1
• Summer Hours

About A-LIGN 

A-LIGN is the leading provider of high-quality, efficient cybersecurity compliance programs. Combining experienced auditors and audit management technology, A-LIGN provides the widest breadth and depth of services including SOC 2, ISO 27001, HITRUST, FedRAMP, and PCI. A-LIGN is the number one issuer of SOC 2 and HITRUST and a top three FedRAMP assessor. To learn more, visit a-lign.com. 

Come Work for A-LIGN! 

Apply online today at A-LIGN.com and learn about life at A-LIGN by following us on LinkedIn.  

A-LIGN is an Equal Opportunity Employer. 

The personal data you provide to us is processed by A-LIGN Bulgaria. Your personal data is shared with employees of A-LIGN, and the candidate data retention period is 6 months. You have the right to obtain information about the processing of your personal data. In addition, you have the right to correct, to block, and to delete your data in accordance with the local laws and regulations. For more information you can visit A-LIGN’s Job Ads Privacy Policy.

Role Summary:

This position will support the activities of two functions within Man Group's Enterprise Risk Management team:

• Operational Risk – focuses on internal risks (things that could go wrong in our day-to-day operations)
• Third Party Risk Management (TPRM) – focuses on external risks from the suppliers and vendors we work with

Both teams identify potential risks, assess how serious they are, and work with other teams across the whole of Man Group to help manage and communicate those risks.

Role Responsibilities

Managing risk processes including:

• Collecting and updating information about risks and controls
• Tracking whether controls are working (attestations)
• Tracking compliance with the standards set out in Man Group’s Risk Management Policies
• Recording problems when they occur and tracking actions to closure
• Maintaining lists of all our vendors and assessing their levels of risk
• Monitoring performance targets and escalating issues
• Maintaining accurate records and timelines

Managing data and creating reports

• Making sure all risk data is accurate, complete, and up-to-date
• Monitoring news and industry events for risks that might affect us
• Building dashboards and reports, including automation
• Preparing draft materials for senior management meetings

Continuous process improvement

• Creating automated workflows to reduce manual work (e.g., approval requests, reminders, data updates)
• Checking data quality fixing any issues
• Developing ways of using AI to review and challenge risk and control data
• Creating clear process maps and documentation
• Finding ways to make processes more efficient
• Helping to test and improve our risk management systems

Candidate requirements:

Knowledge

• Understanding of how companies manage operational risks and controls
• Familiarity with concepts including:
• Risk assessments
• Key risk indicators
• Risk event (error) management
• Issue and Action tracking
• Vendor lifecycle management (onboarding, assessing, monitoring suppliers)

Technical skills

• Excel: advanced skills (data manipulation, lookups, pivot tables)
• Dashboards: ability to build visual reports (e.g. Power BI)
• Automation: experience with workflow tools (e.g. Power Automate)

Working style

• Highly organised with strong attention to detail
• Able to document processes clearly
• Good at breaking down complex problems into manageable steps and asking questions when required
• Comfortable working in a support role, helping risk managers
• Clear communicator who can work with different teams to gather information
• Capable of working on a hybrid basis, combining office-based work for team collaboration and face-to-face engagement with remote working flexibility