What does a GRC analyst do?
Short answer
A GRC analyst helps an organization manage security risk and prove compliance: running risk assessments, maintaining policies and the risk register, collecting audit evidence for frameworks such as SOC 2 or ISO 27001, reviewing vendors and answering customer security questionnaires.
The details
Strong writing, organization and the ability to explain technical risks in business terms matter as much as technical knowledge. AI governance is a growing part of the role.
Useful next reads and tools
Terms explained
- GRC (governance, risk and compliance)
- GRC is the discipline that aligns security with business goals through governance (direction and accountability), risk management (prioritizing threats) and compliance (meeting laws, contracts and standards).
- ISO/IEC 27001
- ISO/IEC 27001 is the international standard for an information security management system (ISMS), against which organizations can be independently certified.
- Risk register
- A risk register is a maintained list of risks with their likelihood, impact, owner, controls, treatment plan and review date.
- SOC 2
- SOC 2 is an attestation report from an independent CPA firm on a service organization’s controls relevant to security, availability, processing integrity, confidentiality and privacy.
Sources
Related questions
Related Guides
GuideGRC
8 Steps to Prepare for a Security Audit (ISO 27001, SOC 2 or Customer Audit)
How to prepare for an ISO 27001, SOC 2 or customer security audit: scope, control mapping, evidence collection, GRC platforms, mock audits, interviews and managing findings.
Read more GuideGRC
How to Build a Security Policy Framework: Policies, Standards and Procedures That People Follow
A practical guide to writing, approving and maintaining information security policies: the policy hierarchy, the core policy set, ownership, review cycles and how to prove people follow them.
Read more GuideGRC
10 Steps to Implement ISO 27001 and Get Certified
A step-by-step ISO/IEC 27001:2022 implementation plan: scope, leadership, risk assessment, Statement of Applicability, Annex A controls, internal audit, management review and the certification audit.
Read more GuideGRC
How to Conduct a Cybersecurity Risk Assessment in 7 Steps
A step-by-step method for information security risk assessment aligned with ISO 27005 and NIST SP 800-30: assets, threats, likelihood and impact scoring, risk appetite, treatment and the risk register.
Read more