IT Governance, Risk & Compliance Analyst I

Our commitment to pay range transparency fosters an equitable workplace, where everyone can feel valued. The annual compensation range for this position is stated below. The salary offered within this range will be based upon the geographic location, work experience, education, licensure requirements and/or skill level. Salary Range:

$58,100.00 - $87,100.00

Purpose Statement: The IT Governance, Risk & Compliance Analyst I is responsible for supporting the development, implementation, and monitoring of IT policies, risk management processes, and compliance requirements. This role acts as a first-line representative of the IT Governance, Risk, and Compliance (GRC) team, establishing foundational relationships with technical and non-technical teams to ensure the accurate and timely collection of audit evidence. Additionally, this role is responsible for assisting in the development of proactive IT control plans, executing control tests, and maintaining a high level of attention to detail to enhance overall audit proficiency.

Key Job Accountabilities:

• Compliance Assessment: Assist in conducting internal security reviews and readiness assessments to measure compliance with industry frameworks (e.g., NIST CSF, ISO/IEC 27001, CIS COBIT, CIS Controls) and industry regulations (e.g., SOX, SEC, GDPR, HIPAA).
• Risk Register & Evidence Management: Assist in identifying and documenting IT risks within the Risk Register; serve as a primary coordinator for the collection, organization, and initial quality review of evidence for internal and external audits.
• Control Execution & Monitoring: Support the design of IT controls and execute control tests; proactively track and follow up with stakeholders to ensure the timely completion of evidence submission and control performance.
• Policy Support: Assist in drafting, reviewing, and proposing updates to IT policies, standards, and procedures to ensure documentation remains current and aligned with industry best practices and regulatory changes.
• Third-Party Risk Management (TPRM): Participates in and supports the GRM team in completing security questionnaires from prospective vendors and assists in evaluating the security posture of third-party partnerships against organizational standards.
• All GT team members are responsible for upholding the organization's cybersecurity posture by adhering to security policies and procedures, actively participating in training, protecting data and systems, actively identifying and mitigating vulnerabilities, and promptly reporting any suspicious activity or potential security incidents.

Education/Experience Qualifications:

• Bachelor’s Degree with 1 or more years of related experience is preferred. An equivalent combination of education and/or experience will be considered.
• Industry recognized certifications such as the CompTIA Security+ or the CISA are not required, but preferred.

Other Qualifications:

• Foundational knowledge of industry-standard security frameworks (e.g., NIST CSF, ISO 27001, or CIS Controls) and their application in building a corporate security program is required.
• Basic understanding of core security technologies (e.g., EDR, DLP, SIEM, and Vulnerability Management) and their role in validating control effectiveness and maintaining regulatory compliance is required.
• Ability to translate technical security data into clear, concise documentation and reports for non-technical stakeholders is required.
• Proficiency in spreadsheet software (e.g. Google Sheets, Microsoft Excel) for tracking compliance metrics and generating reports is required.
• Basic grasp of enterprise IT architecture—including cloud environments (GCP/AWS/Azure), networking, and database management—with the ability to identify where security controls are necessary to mitigate risk is preferred.
• Familiarity with Google Cloud, AWS, or Azure cloud security concepts is preferred.
• Experience in technical support or help desk work, preferably in a manufacturing setting, is preferred.

This document does not represent a contract of employment and is not intended to capture every possible assignment the incumbent could be asked to perform.