IT GRC Collaborator
The IT GRC Collaborator is responsible for supporting Governance, Risk and Compliance (GRC) activities, including security compliance monitoring, IT risk assessment, audit coordination and ISMS-related initiatives. The role collaborates with internal stakeholders, including Information Security, Engineering, Infrastructure and business teams, as well as external auditors to help ensure compliance with internal requirements, industry standards and applicable regulations, while supporting the identification and mitigation of technology and information security risks.
🤖 What you will do
1. Risk management (30%)
▪ Participate in IT and Information Security risk assessment activities for systems, applications, infrastructure and new product features;
▪ Identify, document and classify information security and technology risks based on impact, likelihood, and business context;
▪ Support the maintenance of the risk register and monitor the implementation of risk treatment plans;
▪ Monitor the implementation of risk treatment actions and follow up with risk owners to track progress and collect supporting evidence;
2. Compliance and Audit management (30%)
▪ Support compliance initiatives related to ISO/IEC 27001, SOX ITGC, internal policies and applicable regulatory requirements;
▪ Review policies, procedures, standards and operational records to assess compliance with established requirements;
▪ Coordinate with system owners, control owners and business stakeholders to collect, validate, and organize audit evidence;
▪ Facilitate audit activities by scheduling meetings, preparing walkthrough materials, responding to auditor requests and tracking deliverables;
▪ Track audit findings, compliance observations and management action plans and follow up with responsible teams until closure;
▪ Support third-party security assessments and security questionnaires by gathering information and coordinating responses;
3. Control assessment and Monitoring (10%)
▪ Perform control testing activities to evaluate whether IT and security controls are operating as designed and performed consistently;
▪ Support periodic User access reviews by validating user listings, tracking reviewer responses and monitoring remediation activities;
▪ Review production change records to verify appropriate approvals, testing evidence and segregation of duties requirements;
▪ Track remediation progress for identified control gaps and verify closure evidence before completion;
4. AI and Compliance automation (30%)
▪ Utilize AI and automation tools to support risk, compliance, audit and control monitoring activities;
▪ Assist in automating evidence collection, reporting and tracking processes;
▪ Support the development of dashboards and automated workflows for GRC activities;
▪ Identify opportunities to improve efficiency through AI-enabled solutions and process automation;
▪ Ensure the use of AI tools complies with internal governance and security requirements.
👾 What you will need
Education
▪ Bachelor’s degree in Information Technology, Information Security, Management Information Systems or a related field;
Experience
▪ ~1 year of experience in IT risk, information security, compliance, audit, internal controls or related fields;
▪ Experience supporting compliance, audit, risk assessment, or control review activities is preferred;
▪ Experience working with frameworks such as ISO/IEC 27001, SOX ITGC, NIST CSF, COBIT or SOC 2 is an advantage;
▪ Experience using GRC, ticketing, documentation or collaboration tools (e.g., JIRA, ServiceNow, Confluence, SharePoint) is preferred;
Knowledge
▪ Understanding of Information Security principles, cybersecurity concepts and IT risk management;
▪ Familiarity with risk management, compliance, audit and internal control concepts;
▪ Exposure to industry standards and frameworks such as ISO/IEC 27001, SOX ITGC, NIST CSF, COBIT, ITIL, or SOC 2;
▪ Awareness of cybersecurity, privacy, and personal data protection requirements is an advantage;
Technical Skills
▪ Risk assessment and risk analysis;
▪ Control testing and control effectiveness evaluation;
▪ Report preparation, dashboard tracking and documentation management;
▪ Proficiency in Microsoft Excel, PowerPoint, Google Workspace and collaboration tools;
▪ Experience with ticketing, documentation or workflow tools (e.g., Jira, ServiceNow, Confluence, SharePoint) is an advantage;
▪ Basic knowledge of automation tools and workflow automation platforms (e.g., Power Automate, low-code/no-code solutions);
▪ Familiarity with AI tools (e.g., Microsoft Copilot, ChatGPT, AI-assisted productivity tools) for document review, reporting, analysis and compliance-related activities.
