Senior Cybersecurity GRC Analyst

The Position

We are seeking a highly skilled Senior GRC Analyst to join our dynamic cybersecurity team at OPSWAT. In this role, you will lead critical security and privacy compliance initiatives, ensuring that our organization adheres to industry standards, regulatory requirements, and internal policies. You will be instrumental in shaping our governance, risk management, and compliance (GRC) framework, focusing on protecting data confidentiality, integrity, and availability.

As a senior member of the GRC team, you will collaborate across technical and non-technical teams, drive policy development, manage security investigations, and oversee audit activities. Your expertise will support OPSWAT’s mission to maintain robust security certifications, meet vendor onboarding requirements, and proactively respond to evolving cyber threats.

What You Will Be Doing 

• Lead the development, review, and enforcement of security policies, procedures, and processes to ensure compliance with regulatory mandates (e.g., GDPR, CCPA, DORA) and industry standards such as NIST CSF, CIS18, ISO 27001, ISO 42001 and SOC 2.  
• Oversee the implementation and administration of GRC tools and platforms, leveraging automation and AI capabilities to enhance compliance workflows and reporting. 
• Collaborate with cross-functional teams to align security and privacy policies with technology and business processes. 
• Lead internal audits related to security policies and regulatory standards, identifying risks and driving remediation efforts.  
• Coordinate responses to customer security questionnaires and vendor security risk assessments, ensuring timely and accurate fulfillment.  
• Manage and conduct complex security investigations, maintaining chain of custody and ensuring thorough documentation.  
• Develop and maintain data workflows, dashboards, and metrics to monitor Security GRC status and support decision-making.  
• Handle personal data requests and privacy compliance activities in accordance with GDPR, CCPA, and other relevant regulations.  
• Manage security risk processes, including maintaining the risk register, driving risk assessments, treatment plans, and risk-based decision-making. 
• Support in reviewing security logs, alerts, and data to identify risks; contribute to incident investigations, and address compliance gaps. 
• Support implementation and oversight of Data Loss Prevention (DLP) controls across multiple channels. 
• Assess and manage risks related to AI/ML technologies and contribute to AI governance policies to ensure secure and responsible adoption. 

What We Need From You 

• Proven experience (3+ years) in governance, risk, and compliance within cybersecurity or information security environments.  
• Proficiency in English, with strong listening, speaking, reading, and writing skills.
• Deep understanding of security and regulatory frameworks such as NIST CSF, ISO 27001, ISO 42001, DORA, SOC 2, and CIS Controls (CIS18), as well as privacy regulations including GDPR and CCPA.  
• Technical understanding and background related to information systems, cybersecurity, cloud environments, network, and technology risks.  
• Skilled in policy writing, technology audits, security investigations, and data analysis. 
• Experience with risk management frameworks, risk register process, and risk treatment planning. 
• Hands-on experience with audit management, including internal audits and external certification support. 
• Experience in developing control self-assessment process and governance. 
• Understanding of data protection and Data Loss Prevention (DLP) concepts. 
• Basic understanding of AI/ML risks, including data leakage, prompt injection, and governance considerations (preferred). 
• Ability to support risk assessments and governance processes in collaboration with technical teams. 
• Excellent organizational, project management, and communication skills, with the ability to engage both technical and non-technical stakeholders.  
• Self-motivated, resourceful, and eager to stay current with emerging security threats and compliance trends.