GRC Analyst

Ametek, Inc.; Berwyn (PA); On-site; USD 110,000 - 140,000; Full time

Job summary

AMETEK Inc. is seeking a GRC Analyst to lead and administer core components of the IT Risk Management program.

You will coordinate vulnerability risk tracking, exception management, and third-party risk assessments across IT, Security, Legal, and Procurement, reporting to governance committees. The ideal candidate has strong analytics, cybersecurity knowledge, and the ability to communicate risk to both technical and non-technical stakeholders.

Qualifications

• Bachelor's degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business Administration, or a related field.
• 3-7 years of experience in Governance, Risk & Compliance (GRC), Information Security, IT Audit, Risk Management, or Cybersecurity.
• Experience managing IT risk registers, exception management processes, and vulnerability governance programs.
• Experience conducting security and risk assessments for third-party vendors.
• Strong understanding of cybersecurity principles, security controls, and risk management methodologies.
• Experience preparing executive-level risk reporting and metrics.
• Strong written, verbal, and presentation communication skills.
• Ability to manage multiple priorities and work effectively across cross-functional teams.

Responsibilities

• Administer and maintain the enterprise IT Risk Register.
• Facilitate risk identification, assessment, documentation, and mitigation activities across IT and business functions.
• Conduct qualitative and quantitative risk assessments to evaluate potential business impact and likelihood.
• Collaborate with risk owners to develop and track remediation and mitigation plans.
• Monitor risk treatment activities and provide periodic reporting on risk status, trends, and exposure.
• Prepare risk reports and executive summaries for management and governance committees.
• Support enterprise risk management initiatives and ensure alignment with organizational risk appetite and tolerance statements.

Skills

GRC experience

Information Security

Risk management

Vendor risk

Security reporting

Cross-functional communication

Education

Bachelor's degree in IT, Cybersecurity, IS, Risk Management, Business Admin

Tools

ServiceNow GRC

Bitsight

IntelliGRC

OneTrust

AuditBoard

Job description

Select how often (in days) to receive an alert:

The GRC Analyst is responsible for leading and administering key components of the organization's IT Risk Management program. This role serves as the central coordinator for vulnerability risk tracking, exception management, and third-party risk assessments. The analyst will partner closely with Information Security, Infrastructure, Audit Services, Legal, Procurement, and business stakeholders to identify, assess, monitor, and report risks that could impact the organization's operations, regulatory compliance, security posture, and strategic objectives.

The ideal candidate possesses strong analytical skills, knowledge of cybersecurity and risk management frameworks, and the ability to communicate risk effectively to both technical and non-technical stakeholders.

Key Responsibilities:

• Administer and maintain the enterprise IT Risk Register.
• Facilitate risk identification, assessment, documentation, and mitigation activities across IT and business functions.
• Conduct qualitative and quantitative risk assessments to evaluate potential business impact and likelihood.
• Collaborate with risk owners to develop and track remediation and mitigation plans.
• Monitor risk treatment activities and provide periodic reporting on risk status, trends, and exposure.
• Prepare risk reports and executive summaries for management and governance committees.
• Support enterprise risk management initiatives and ensure alignment with organizational risk appetite and tolerance statements.

Vulnerability Risk Tracking

• Serve as the governance lead for vulnerability risk management processes.
• Review vulnerability assessment results to identify high-risk findings requiring remediation.
• Track remediation activities and validate closure of identified vulnerabilities.
• Coordinate with Security Operations team to ensure vulnerabilities are remediated within established service level targets.
• Facilitate risk acceptance reviews when vulnerabilities cannot be remediated within required timelines.
• Develop metrics and reporting for vulnerability aging, remediation performance, and risk exposure.
• Escalate critical vulnerabilities and overdue remediation efforts to management as appropriate.

Exception Management

• Administer and maintain the IT Security Exception Register.
• Review requests for policy, security standard, or technical control exceptions.
• Facilitate risk assessments associated with exception requests.
• Document compensating controls and residual risk evaluations.
• Coordinate approval workflows with risk owners, security leadership, and business stakeholders.
• Track exception expiration dates and conduct periodic reviews to ensure continued business justification.
• Report on exception trends, concentrations, and emerging risk patterns.

Third-Party Risk Management

• Lead the cybersecurity assessment process for vendors, suppliers, service providers, and business partners.
• Conduct third-party security reviews, including analysis of security questionnaires, audit reports, certifications, and independent assessments.
• Review customer questionnaires and provide feedback in accordance with AMETEK policies and standards.
• Identify and document residual risks associated with third-party relationships.
• Collaborate with Procurement, Legal, Information Security, and business sponsors throughout the vendor lifecycle.
• Monitor remediation of identified vendor findings and risk treatment plans.
• Support ongoing vendor risk monitoring and reassessment activities.

Required Qualifications:

• Bachelor's degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business Administration, or a related field.
• 3-7 years of experience in Governance, Risk & Compliance (GRC), Information Security, IT Audit, Risk Management, or Cybersecurity.
• Experience managing IT risk registers, exception management processes, and vulnerability governance programs.
• Experience conducting security and risk assessments for third-party vendors.
• Strong understanding of cybersecurity principles, security controls, and risk management methodologies.
• Experience preparing executive-level risk reporting and metrics.
• Strong written, verbal, and presentation communication skills.
• Ability to manage multiple priorities and work effectively across cross-functional teams.

Preferred Qualifications:

• Professional certifications such as CISA, CRISC, CISSP, or CISM
• Working knowledge of frameworks such as NIST CSF, NIST RMF, ISO 27001, SOC 2, COBIT, PCI-DSS, SOX
• Experience with third party risk platforms such as Bitsight.
• Experience with GRC platforms such as ServiceNow GRC, Vanta, IntelliGRC, OneTrust, AuditBoard.

Applicants must have the legal right to work in the United States on a full-time basis without the need for employer sponsorship now or in the future. The Company cannot offer employment to F-1 (student) visa holders who require employer sponsorship in the future or cannot work now on a full-time basis.

#LI-BM1

Compensation

Employee Type: Salaried

Currency: USD

Salary Minimum: 110,000

Salary Maximum: 140,000

Incentive: No

Disclaimer:Where a specific pay range is noted, it is a good faith estimate at the time of this posting. The actual salary offered will be based on experience, skills, qualifications, market / business considerations, and geographic location.

For more information on AMETEK's competitive benefits, please click here .

AMETEK, Inc. is a leading global provider of industrial technology solutions serving a diverse set of attractive niche markets with annual sales over $7.5billion.

AMETEK is committed to making a safer, sustainable, and more productive world a reality. We use differentiated technology solutions to solve our customers' most complex challenges. We employ 22,000colleagues, in 35countries, that are grounded by our core values: Ethics and Integrity, Respect for the Individual, Inclusion, Teamwork, and Social Responsibility. AMETEK isacomponent of the S&P 500. Visit https://www.ametek.com/careers for more information.

We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age, national origin, religion, sexual orientation, gender identity, status as a veteran, and basis of disability or any other federal, state or local protected class.Individuals who need a reasonable accommodation because of a disability for any part of the employment process should call 1 [phone].