Governance, Risk & Compliance (GRC) Senior Analyst

Bennett Thrasher; Atlanta (GA); On-site; USD 95,000 - 125,000; Full time

Job summary

Bennett Thrasher is seeking a Governance, Risk & Compliance (GRC) Senior Analyst to support our technology compliance, risk, and data-governance programs in an on-site Atlanta setting.

This hands-on role maintains SOC 2 readiness, coordinates IT controls and access reviews, and administers security awareness activities while ensuring audit-ready documentation.

Qualifications

• 4+ years of experience in IT GRC, IT audit, cybersecurity compliance, technology risk, SOC/SOX controls, or information security.
• Understanding of IT controls, audit evidence, and risk-management concepts.
• Experience with Microsoft 365 or similar enterprise technology environments.
• Strong organization, documentation, communication, and follow-through skills.
• Ability to work independently and coordinate across multiple teams.

Responsibilities

• Maintain SOC 2 control calendar and coordinate recurring control activities.
• Collect, review, and maintain audit evidence and documentation.
• Track control gaps, exceptions, remediation plans, and outstanding items.
• Coordinate SOC 2 readiness activities and external auditor requests.
• Perform recurring user and privileged-access reviews.
• Support Microsoft Purview, including data classification, DLP, sensitivity labeling, and retention.
• Assist with development and implementation of the firm’s data-retention program.
• Administer security awareness campaigns, phishing simulations, and reporting.
• Maintain IT compliance and security policies and coordinate periodic reviews.
• Review change requests for compliance, risk, data protection, and audit requirements, ensuring proper approvals and documentation.
• Assist with technology risk assessments, vendor security reviews, and client security questionnaires.
• Maintain risk and remediation registers and follow up with control owners.
• Prepare compliance reporting for IT leadership.
• Identify opportunities to automate compliance monitoring and evidence collection.
• Escalate significant control failures, risks, and policy exceptions.

Skills

IT GRC

IT audit

Cybersecurity compliance

Technology risk

SOC/SOX controls

Info security

Organization

Independent work

Tools

Microsoft 365

GRC platforms

Job description

Governance, Risk & Compliance (GRC) Senior Analyst

Job Category: Information Technology

Requisition Number: GOVER001365

• Posted : October 5, 2026
• Full-Time
• On-site

Locations

Showing 1 location

Atlanta, GA | Atlanta, GA
Atlanta, GA 30339, USA

Description

Bennett Thrasher is seeking an IT Governance, Risk & Compliance (GRC) Analyst to support our technology compliance, risk, and data-governance programs.

This hands-on role helps maintain year-round SOC 2 readiness, coordinates IT controls and access reviews, supports Microsoft Purview and data-retention initiatives, administers security awareness activities, and ensures compliance documentation remains organized and audit-ready.

The ideal candidate has experience in IT audit, GRC, cybersecurity compliance, or technology risk and is ready to continue developing their expertise.

What You’ll Do

• Maintain the SOC 2 control calendar and coordinate recurring control activities.
• Collect, review, and maintain audit evidence and documentation.
• Track control gaps, exceptions, remediation plans, and outstanding items.
• Coordinate SOC 2 readiness activities and external auditor requests.
• Perform and document recurring user and privileged-access reviews.
• Support Microsoft Purview, including data classification, DLP, sensitivity labeling, and retention.
• Assist with development and implementation of the firm’s data-retention program.
• Administer security awareness campaigns, phishing simulations, and reporting.
• Maintain IT compliance and security policies and coordinate periodic reviews.
• Review change requests for compliance, risk, data protection, and audit requirements, ensuring proper approvals and documentation.
• Assist with technology risk assessments, vendor security reviews, and client security questionnaires.
• Maintain risk and remediation registers and follow up with control owners.
• Prepare compliance reporting for IT leadership.
• Identify opportunities to automate compliance monitoring and evidence collection.
• Escalate significant control failures, risks, and policy exceptions.
• Review change requests for compliance, risk, data protection, and audit requirements, ensuring proper approvals and documentation.

What We’re Looking For

• 4+ years of experience in IT GRC, IT audit, cybersecurity compliance, technology risk, SOC/SOX controls, or information security.
• Understanding of IT controls, audit evidence, and risk-management concepts.
• Experience with Microsoft 365 or similar enterprise technology environments.
• Strong organization, documentation, communication, and follow-through skills.
• Ability to work independently and coordinate across multiple teams.

Preferred

• SOC 2 audit or readiness experience.
• Experience with access reviews or GRC/compliance platforms.
• Vendor/third-party risk experience.
• Security awareness program administration.
• Experience in accounting, financial services, professional services, or another environment handling sensitive client information.
• Security+, CISA, CRISC, CGRC, Microsoft security/compliance, or similar certification—or interest in pursuing one.

Equal Opportunity Employer
This employer is required to notify all applicants of their rights pursuant to federal employment laws.For further information, please review the Know Your Rights notice from the Department of Labor.