Information Security GRC Analyst

The posting, as Barnes & Thornburg LLP wrote it

Summary: As a member of the Information Security team, the Information Security GRC Analyst supports the firm’s technology risk management policies, procedures, and guidelines. This role helps ensure that technology risks are measured, prioritized, and appropriately maintained in the risk register. Working under the direction of the Information Security Governance Manager, the GRC Analyst will help analyze, document, and track risks related to business operations, and will support the monitoring and improvement of risk management processes.

Key Responsibilities

• Serve as a point of contact for IT and non-IT stakeholders on technology-related risk questions, escalating issues to senior team members and management as appropriate.
• Support other professionals in technology risk management, covering areas such as risk assessments, security policy and documentation management, third-party risk management, and ISO 27001 ISMS operations.
• Help identify and assess technology-related risks and maintain the Information Security Risk Register.
• Assist with periodic risk reporting to executive management, documenting management’s response to identified risks.
• Assist with IT Risk Assessments for on-premises and cloud-based infrastructure, platforms, applications, and key technology services, in line with IT Risk Management Methodology.
• Help assess the risks associated with major IT changes and technology implementations.
• Track and process exceptions and waivers related to internal security standards, unapproved software, web/email content filtering, password policies, etc.
• Work with IT Infrastructure to help ensure that security controls are integrated into Business Continuity/Disaster Recovery planning, ensuring the continuity of security controls where applicable.
• Assist with the operation of the Information Security Management System (ISMS) and Privacy Information Management System (PIMS) in alignment with ISO 27001:2022 and ISO 27701:2019 standards.
• Track and maintain security control requirements from various sources, including ISO 27001 annex controls, client requirements, legal/regulatory guidelines, and other relevant frameworks.
• Assist in responding to security audits, questionnaires, and assessments from clients and external parties, supporting marketing and procurement teams with security-related content for client RFPs and vendor agreements.
• Help analyze business and IT processes from an information security perspective and identify potential improvements.
• Review policies and procedures to help ensure security control requirements are adequately covered, suggesting updates and improvements as necessary.
• Support the periodic review and update of security policies in accordance with firm guidelines.
• Support the Security Awareness Program, including assisting with planning and curriculum development.
• Assist with content creation and delivery schedules for both broad and targeted secur

[…]
kills and be extremely detail-oriented; attention to detail, high-level of accuracy, issue-tracking, follow-up and resolution skills are essential.

• Ability to maintain confidentiality and discretion of sensitive information.
• Ability to work collaboratively and, with guidance, independently; eagerness to learn and develop GRC skills.
• Familiarity with project management tools (e.g. Microsoft Project, Asana, Trello) preferred.

Working Conditions

• Normal office environment with little exposure to excessive noise, dust, temperature and the like.
• Specific work hours for this position will be assigned; generally, core business hours. The requirements may vary occasionally, depending on the needs of the Firm.

The above is intended to describe the general content of and requirements for the performance of this job. It is not to be construed as an exhaustive statement of essential functions, responsibilities or requirements.Subject to firm needs, duties and responsibilities of this position may change at any time, on a temporary or permanent basis, and with or without notice.

Equal Employment and Opportunity Statement

Barnes & Thornburg is committed to equal employment opportunity in both principle and as a matter of policy. We will recruit, hire, train, promote, compensate and provide benefits to all applicants and employees without regard to ancestry, sex, race, color, ethnicity, national origin, gender, age, religion, religious creed, mental and/or physical disability, medical condition, military and/or veteran’s status, genetic information, marital status, sexual orientation, gender identity and/or expression, or any other basis protected by applicable federal, state and local laws. This policy applies to all recruiting, hiring, promotions, upgrades, layoffs, compensation, benefits, terminations and all other privileges, terms and conditions of employment. The firm complies fully with all federal, state and local equal employment opportunity laws.