Grc Analyst Jobs
Grc Analyst jobs are open across financial services, healthcare, technology, and government contracting, from entry-level to senior and lead roles, with specializations in compliance program management, enterprise risk frameworks, and IT security governance. Find a role that fits from the openings below and apply directly.
Find Grc Analyst JobsOverview
Showing 5 of 68+ Grc Analyst jobs
Berwyn, PA, US, 19312
The GRC Analyst is responsible for leading and administering key components of the organization's IT Risk Management program. This role serves as the central coordinator for vulnerability risk tracking, exception management, and third-party risk assessments. The analyst will partner closely with Information Security, Infrastructure, Audit Services, Legal, Procurement, and business stakeholders to identify, assess, monitor, and report risks that could impact the organization's operations, regulatory compliance, security posture, and strategic objectives.
The ideal candidate possesses strong analytical skills, knowledge of cybersecurity and risk management frameworks, and the ability to communicate risk effectively to both technical and non-technical stakeholders.
Key Responsibilities:
IT Risk Management
- Administer and maintain the enterprise IT Risk Register.
- Facilitate risk identification, assessment, documentation, and mitigation activities across IT and business functions.
- Conduct qualitative and quantitative risk assessments to evaluate potential business impact and likelihood.
- Collaborate with risk owners to develop and track remediation and mitigation plans.
- Monitor risk treatment activities and provide periodic reporting on risk status, trends, and exposure.
- Prepare risk reports and executive summaries for management and governance committees.
- Support enterprise risk management initiatives and ensure alignment with organizational risk appetite and tolerance statements.
Vulnerability Risk Tracking
- Serve as the governance lead for vulnerability risk management processes.
- Review vulnerability assessment results to identify high-risk findings requiring remediation.
- Track remediation activities and validate closure of identified vulnerabilities.
- Coordinate with Security Operations team to ensure vulnerabilities are remediated within established service level targets.
- Facilitate risk acceptance reviews when vulnerabilities cannot be remediated within required timelines.
- Develop metrics and reporting for vulnerability aging, remediation performance, and risk exposure.
- Escalate critical vulnerabilities and overdue remediation efforts to management as appropriate.
Exception Management
- Administer and maintain the IT Security Exception Register.
- Review requests for policy, security standard, or technical control exceptions.
- Facilitate risk assessments associated with exception requests.
- Document compensating controls and residual risk evaluations.
- Coordinate approval workflows with risk owners, security leadership, and business stakeholders.
- Track exception expiration dates and conduct periodic reviews to ensure continued business justification.
- Report on exception trends, concentrations, and emerging risk patterns.
Third-Party Risk Management
- Lead the cybersecurity assessment process for vendors, suppliers, service providers, and business partners.
- Conduct third-party security reviews, including analysis of security questionnaires, audit reports, certifications, and independent assessments.
- Review customer questionnaires and provide feedback in accordance with AMETEK policies and standards.
- Identify and document residual risks associated with third-party relationships.
- Collaborate with Procurement, Legal, Information Security, and business sponsors throughout the vendor lifecycle.
- Monitor remediation of identified vendor findings and risk treatment plans.
- Support ongoing vendor risk monitoring and reassessment activities.
Required Qualifications:
- Bachelor's degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business Administration, or a related field.
- 3-7 years of experience in Governance, Risk & Compliance (GRC), Information Security, IT Audit, Risk Management, or Cybersecurity.
- Experience managing IT risk registers, exception management processes, and vulnerability governance programs.
- Experience conducting security and risk assessments for third-party vendors.
- Strong understanding of cybersecurity principles, security controls, and risk management methodologies.
- Experience preparing executive-level risk reporting and metrics.
- Strong written, verbal, and presentation communication skills.
- Ability to manage multiple priorities and work effectively across cross-functional teams.
Preferred Qualifications:
- Professional certifications such as CISA, CRISC, CISSP, or CISM
- Working knowledge of frameworks such as NIST CSF, NIST RMF, ISO 27001, SOC 2, COBIT, PCI-DSS, SOX
- Experience with third party risk platforms such as Bitsight.
- Experience with GRC platforms such as ServiceNow GRC, Vanta, IntelliGRC, OneTrust, AuditBoard.
Applicants must have the legal right to work in the United States on a full-time basis without the need for employer sponsorship now or in the future. The Company cannot offer employment to F-1 (student) visa holders who require employer sponsorship in the future or cannot work now on a full-time basis.
#LI-BM1
Compensation
Disclaimer: Where a specific pay range is noted, it is a good faith estimate at the time of this posting. The actual salary offered will be based on experience, skills, qualifications, market / business considerations, and geographic location.
For more information on AMETEK's competitive benefits, please click here.
AMETEK, Inc. is a leading global provider of industrial technology solutions serving a diverse set of attractive niche markets with annual sales over $7.5 billion.
AMETEK is committed to making a safer, sustainable, and more productive world a reality. We use differentiated technology solutions to solve our customers’ most complex challenges. We employ 22,000 colleagues, in 35 countries, that are grounded by our core values: Ethics and Integrity, Respect for the Individual, Inclusion, Teamwork, and Social Responsibility. AMETEK is a component of the S&P 500. Visit https://www.ametek.com/careers for more information.
We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age, national origin, religion, sexual orientation, gender identity, status as a veteran, and basis of disability or any other federal, state or local protected class. Individuals who need a reasonable accommodation because of a disability for any part of the employment process should call 1 (866) 263-8359.
Berwyn, PA, US, 19312
The GRC Analyst is responsible for leading and administering key components of the organization's IT Risk Management program. This role serves as the central coordinator for vulnerability risk tracking, exception management, and third-party risk assessments. The analyst will partner closely with Information Security, Infrastructure, Audit Services, Legal, Procurement, and business stakeholders to identify, assess, monitor, and report risks that could impact the organization's operations, regulatory compliance, security posture, and strategic objectives.
The ideal candidate possesses strong analytical skills, knowledge of cybersecurity and risk management frameworks, and the ability to communicate risk effectively to both technical and non-technical stakeholders.
Key Responsibilities:
IT Risk Management
- Administer and maintain the enterprise IT Risk Register.
- Facilitate risk identification, assessment, documentation, and mitigation activities across IT and business functions.
- Conduct qualitative and quantitative risk assessments to evaluate potential business impact and likelihood.
- Collaborate with risk owners to develop and track remediation and mitigation plans.
- Monitor risk treatment activities and provide periodic reporting on risk status, trends, and exposure.
- Prepare risk reports and executive summaries for management and governance committees.
- Support enterprise risk management initiatives and ensure alignment with organizational risk appetite and tolerance statements.
Vulnerability Risk Tracking
- Serve as the governance lead for vulnerability risk management processes.
- Review vulnerability assessment results to identify high-risk findings requiring remediation.
- Track remediation activities and validate closure of identified vulnerabilities.
- Coordinate with Security Operations team to ensure vulnerabilities are remediated within established service level targets.
- Facilitate risk acceptance reviews when vulnerabilities cannot be remediated within required timelines.
- Develop metrics and reporting for vulnerability aging, remediation performance, and risk exposure.
- Escalate critical vulnerabilities and overdue remediation efforts to management as appropriate.
Exception Management
- Administer and maintain the IT Security Exception Register.
- Review requests for policy, security standard, or technical control exceptions.
- Facilitate risk assessments associated with exception requests.
- Document compensating controls and residual risk evaluations.
- Coordinate approval workflows with risk owners, security leadership, and business stakeholders.
- Track exception expiration dates and conduct periodic reviews to ensure continued business justification.
- Report on exception trends, concentrations, and emerging risk patterns.
Third-Party Risk Management
- Lead the cybersecurity assessment process for vendors, suppliers, service providers, and business partners.
- Conduct third-party security reviews, including analysis of security questionnaires, audit reports, certifications, and independent assessments.
- Review customer questionnaires and provide feedback in accordance with AMETEK policies and standards.
- Identify and document residual risks associated with third-party relationships.
- Collaborate with Procurement, Legal, Information Security, and business sponsors throughout the vendor lifecycle.
- Monitor remediation of identified vendor findings and risk treatment plans.
- Support ongoing vendor risk monitoring and reassessment activities.
Required Qualifications:
- Bachelor's degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business Administration, or a related field.
- 3-7 years of experience in Governance, Risk & Compliance (GRC), Information Security, IT Audit, Risk Management, or Cybersecurity.
- Experience managing IT risk registers, exception management processes, and vulnerability governance programs.
- Experience conducting security and risk assessments for third-party vendors.
- Strong understanding of cybersecurity principles, security controls, and risk management methodologies.
- Experience preparing executive-level risk reporting and metrics.
- Strong written, verbal, and presentation communication skills.
- Ability to manage multiple priorities and work effectively across cross-functional teams.
Preferred Qualifications:
- Professional certifications such as CISA, CRISC, CISSP, or CISM
- Working knowledge of frameworks such as NIST CSF, NIST RMF, ISO 27001, SOC 2, COBIT, PCI-DSS, SOX
- Experience with third party risk platforms such as Bitsight.
- Experience with GRC platforms such as ServiceNow GRC, Vanta, IntelliGRC, OneTrust, AuditBoard.
Applicants must have the legal right to work in the United States on a full-time basis without the need for employer sponsorship now or in the future. The Company cannot offer employment to F-1 (student) visa holders who require employer sponsorship in the future or cannot work now on a full-time basis.
#LI-BM1
Compensation
Disclaimer: Where a specific pay range is noted, it is a good faith estimate at the time of this posting. The actual salary offered will be based on experience, skills, qualifications, market / business considerations, and geographic location.
For more information on AMETEK's competitive benefits, please click here.
AMETEK, Inc. is a leading global provider of industrial technology solutions serving a diverse set of attractive niche markets with annual sales over $7.5 billion.
AMETEK is committed to making a safer, sustainable, and more productive world a reality. We use differentiated technology solutions to solve our customers’ most complex challenges. We employ 22,000 colleagues, in 35 countries, that are grounded by our core values: Ethics and Integrity, Respect for the Individual, Inclusion, Teamwork, and Social Responsibility. AMETEK is a component of the S&P 500. Visit https://www.ametek.com/careers for more information.
We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age, national origin, religion, sexual orientation, gender identity, status as a veteran, and basis of disability or any other federal, state or local protected class. Individuals who need a reasonable accommodation because of a disability for any part of the employment process should call 1 (866) 263-8359.
Grc Analyst Jobs by Experience Level
See All 68 Grc Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Grc Analyst JobsGrc Analyst Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Manufacturing
- Consulting & Professional Services
What Employers Look For
The qualifications that appear most often in grc analyst jobs.
- Bachelor's degree in information security, business, finance, or a related field
- Hands-on experience with frameworks such as NIST CSF, ISO 27001, SOC 2, or COBIT
- Proficiency in GRC platforms such as ServiceNow GRC, Archer, or OneTrust
- Professional certification such as CISA, CRISC, CISM, or CompTIA Security+
- Experience conducting risk assessments, control testing, and audit evidence collection
- Strong written communication skills for policy documentation and executive reporting
Tips for Your Grc Analyst Job Search
Tailor your resume to framework keywords
GRC job postings frequently filter candidates by named frameworks like NIST CSF, ISO 27001, or SOC 2. Pull the exact framework acronyms from each posting and mirror them in your resume's skills and experience sections, not just a generic skills list.
Highlight your certification timing strategically
If you're pursuing CISA, CRISC, or CISSP, list it as 'in progress' with your expected exam date. Hiring managers for grc analyst roles often prefer a candidate actively testing over one with no certification path visible at all.
Apply early to roles that fit
Migrate Mate lists grc analyst openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Filter openings by regulated industry first
A grc analyst role in healthcare operates under HIPAA and HITRUST, while one in financial services centers on SOX and PCI DSS. Targeting industries where you already know the regulatory environment makes your application far more competitive than applying broadly.
Prepare a controls-testing scenario for interviews
Most grc analyst interviews include a scenario question about a failed control or an audit finding. Walk through how you'd scope the issue, assign risk ownership, and document remediation. Practicing one or two realistic walkthroughs before the interview is more useful than rehearsing definitions.
Negotiate using scope, not just title
When negotiating a grc analyst offer, ask about the number of business units in scope, whether the role owns policy writing or only monitors, and who the function reports to. These scope details affect workload and career trajectory as much as the base offer does.
Grc Analyst Jobs: Frequently Asked Questions
Which companies are hiring the most grc analysts?
The companies hiring the most grc analysts right now include TikTok USDS Joint Venture, TikTok USDS JV, and Thomas Jefferson University & Jefferson Health, with the largest share of openings in California, Pennsylvania, and Georgia, based on current listings on Migrate Mate as of November 2026. Demand is concentrated in financial services, defense contracting, and large healthcare systems that operate under multiple regulatory frameworks simultaneously.
How many grc analyst jobs are remote?
About 78% of grc analyst openings are fully remote or hybrid as of November 2026, reflecting the desk-based and documentation-heavy nature of the role. Sub-specializations focused on policy management, vendor risk assessment, and compliance monitoring tend to offer the highest share of remote arrangements, while roles requiring hands-on audit walkthroughs or on-site system access are more likely to require in-person presence.
How do you become a grc analyst?
Start by building foundational knowledge in information security and regulatory compliance through a relevant degree or self-study using O*NET occupation guidance for the role's core competencies. Earn an entry-level certification such as CompTIA Security+ or the Certified in Risk and Information Systems Control credential. Then pursue roles with direct exposure to control testing, policy documentation, or internal audit work to build the hands-on experience most employers require before hiring into a dedicated grc analyst position.
Can you get a grc analyst job with little or no experience?
Yes, entry-level grc analyst roles exist, and employers often hire candidates who can demonstrate regulatory awareness even without formal job titles. Internships in internal audit, IT compliance, or information security operations are the most direct path in. Passing the CompTIA Security+ or completing a GRC platform certification on tools like ServiceNow GRC can offset limited experience. Roles at smaller companies or in compliance-adjacent positions such as risk analyst or audit associate are also practical entry points.
What does the grc analyst interview process look like?
Most grc analyst interview processes include an initial recruiter screen focused on regulatory background and tool familiarity, followed by a hiring manager interview that covers framework knowledge and past audit or risk assessment work. A technical or scenario-based round is common, where candidates walk through how they would handle a control failure, gap assessment, or policy exception. Final-stage interviews often involve the compliance, legal, or IT security leadership team depending on the organization's reporting structure.
Where can I find and apply to grc analyst jobs?
You can find and apply to grc analyst jobs on Migrate Mate, which lists current openings from across the United States in one place. Find roles that match your experience level, industry focus, and framework background, then apply directly to each listing without being redirected away from your search.
See All 68 Grc Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Grc Analyst Jobs