[Hiring] GRC Analyst @Cast & Crew

Role Description

The GRC Analyst supports the Information Security Office by managing third-party vendor risk, processing security questionnaires, and assisting with audit and compliance activities across the enterprise. This role is well-suited for someone with a strong compliance background who is looking to grow within information security. The ideal candidate is detail-oriented, organized, and experienced working with compliance frameworks, audit processes, and GRC tools such as Drata or similar platforms. A willingness to learn security concepts and stay current on evolving practices is essential.

• Managing the end-to-end third-party vendor risk management program, including onboarding assessments, periodic reviews, and ongoing monitoring of vendor security posture.
• Supporting an internal ISRM program focused on uncovering cybersecurity risk and adding it to a risk register for prioritization and acceptance and ownership or remediation.
• Completing and responding to inbound security questionnaires (e.g., SIG, CAIQ, custom questionnaires) from clients and partners in a timely and accurate manner.
• Coordinating information gathering and interviewing of internal stakeholders to support third-party security questionnaire responses.
• Supporting and maintaining the organization's compliance automation platforms (e.g., Drata and Andromeda), including evidence collection, control mapping, and readiness tracking.
• Supporting SOC 1 Type 2 and SOC 2 Type 2 audits, including evidence collection, auditor coordination, and remediation of identified gaps.
• Developing, maintaining, and improving security documentation, policies, standards, procedures, and runbooks.
• Monitoring and reporting on internal control effectiveness and audit readiness posture.
• Advising internal lines of business, IT partners, and third parties on how to remediate security gaps identified through assessments or audits.
• Understanding applicable regulations, guidelines, and industry best practices to manage risk and ensure compliance.
• Drafting and presenting risk reports and proposals to executive leadership and senior staff.
• Performing other duties as directed.

Qualifications

• The following certifications are a plus, but are not expected at the time of hire:
• CISA or CISM (compliance/audit-focused; strongly relevant to this role)
• CRISC (risk and controls focus)
• CISSP, GIAC/GSEC, or vendor certifications (AWS/Azure)

Requirements

• 5+ years of experience in compliance, audit, GRC, or a related field, with exposure to information security concepts. Equivalent experience in risk management, regulatory compliance, or internal audit will be considered.
• Working knowledge of the following:
• Compliance frameworks, audit processes, or risk management programs
• SOC 1 or SOC 2 audit support or audit evidence collection (direct audit experience a plus)
• Development or maintenance of policies, procedures, and compliance documentation
• Third-party or vendor risk processes (experience with formal TPRM programs a plus)
• GRC or compliance automation tools (e.g., Drata, Andromeda, or similar platforms)

Benefits

• Cast & Crew provides a comprehensive package of employee benefits including:
• Medical
• Dental
• Vision
• PTO
• Health and wellness programs
• Employee discounts
• And more!
• Note: Cast & Crew benefits are subject to eligibility requirements.