GRC Analyst

City of Indianapolis; Indianapolis (IN); On-site; USD 65,000 - 95,000; Full time

Job summary

City of Indianapolis seeks a GRC Analyst to implement internal control reviews, test and monitor access reviews, vendor assessments, and security reviews. The role ensures alignment with regulatory requirements and internal policies, reporting to the CISO.

The candidate will work with the Information Services Agency to support risk, compliance, and data governance initiatives, using ServiceNow and Microsoft Security Suite for oversight and documentation.

Qualifications

• Bachelor’s degree in computer science, information systems, IT, or related field or equivalent work experience.
• 2-3 years in governance, risk and compliance roles.
• Familiarity with risk assessment methodologies and control frameworks (COSO, COBIT, NIST).
• Experience with CIS Benchmarks, NIST, CJIS, PCI and related standards.
• Familiarity with Microsoft Security suite and ServiceNow.

Responsibilities

• Ensure adherence to regulatory requirements and internal policies.
• Monitor CIS Benchmarks, NIST, CJIS, PCI standards and policy.
• Support vendor assessments and scalable evaluation templates.
• Manage Third-party risk via Vendor Risk Management program.
• Collaborate with partners to ensure compliance and data governance.
• Assist incident documentation and root-cause analysis with Security Manager.
• Support data governance and reporting for risk and compliance.

Education

Bachelor’s degree in computer science or related field

2-3 years governance, risk and compliance experience

Strong understanding of risk assessment methodologies

Familiarity with COSO, COBIT, NIST

Experience with CIS Benchmarks, NIST, CJIS, PCI

Microsoft Security suite, ServiceNow

Tools

ServiceNow

Microsoft Security Suite

Job description

Overview

Job Summary

The Governance, Risk, and Compliance (GRC) Analyst is responsible for implementing the internal control review program. This includes testing, monitoring, and oversight of periodic access reviews, vendor assessments, physical security reviews, encryption/AV reviews, and more. The role involves ensuring that the organization adheres to regulatory requirements and internal policies, and it requires a keen eye for detail and strong analytical skills. Position reports to the CISO.

Agency Summary

The purpose and mission of the Information Services Agency provides information technology services to the city and county. It helps each of the city and county agencies and departments achieve their mission through technology solutions. Information Services Agency aligns its objectives with the business of city and county partners to provide accessible and reliable services to residents, businesses, and visitors. The agency can do this by cultivating a productive, collaborative, and compliant work environment for our workforce to meet the needs of the residents of Indianapolis and Marion County.

Equal Employment Opportunity

The City of Indianapolis Marion County is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status. We value diversity in perspectives and experiences among colleagues and the residents of this city of whom we serve.

Position Responsibilities

• Ensure adherence to regulatory requirements and internal policies.
• Monitor and stay current on CIS Benchmarks, NIST, CJIS, PCI, and other relevant standards, guidance, and policy.
• Research and develop templates to support scalable assessment of vendors, solutions, etc.
• Manage Third party risk via a Vendor Risk Management program including assessments, monitoring and management.
• Build relationships with key agency partners and vendors to support collaborative assessments.
• Track contractually obligated security deliverables for ISA contracts and collaborate to ensure compliance.
• Manage risk and compliance register to guide strategic decision making and ensure compliance.
• In the event of a security incident, support Incident Manager in completing documentation, to include root cause analysis and subsequence problem review and resolution.
• Collaborate with Security Manager to ensure recurring security training includes relevant risk and compliance content.
• Serve as compliance administrator to focus on regulatory compliance.
• Monitor and track remediations efforts for compliance and security findings.
• Develop reporting capabilities for all tracked items
• Collaborate with team on data security controls including information protection.
• Support ticket management in Service Now
• Collaborate on standards and documentation to support data governance and risk management.
• Must maintain confidentiality at all times.

This list of duties and responsibilities is not intended to be all-inclusive and may be expanded to include other duties or responsibilities that management may deem necessary from time to time.

Qualifications

Minimum Job Requirements and Qualifications

• Bachelor’s degree in computer science, Information Systems, Information Technology, or a related field, or equivalent work experience.
• At least 2-3 years of experience in governance, risk, and compliance roles.
• Strong understanding of risk assessment methodologies and control frameworks (e.g., COSO, COBIT, NIST)
• Experience with CIS Benchmarks, NIST, CJIS, PCI, and other relevant standards.
• Familiarity with relevant platforms including Microsoft Security suite, Service Now.
• Excellent analytical skills and attention to detail.
• Strong verbal and written communication skills.
• Ability to work independently and as part of a team.

Preferred Job Requirements And Qualifications

• Master’s Degree in Computer Science, Data Science or Analytics, Law degree focused on Privacy, or a related field.
• Professional certifications such as CISA, CRISC, CISM, CISSP, or GRCP

Working Conditions

Essential functions are regularly performed in an office setting without exposure to adverse environmental conditions.

Physical Conditions

• Sitting at a desk the majority of the day
• Some lifting, carrying, pushing and/or pulling of objects and materials of light weight (5-10) pounds
• Tasks may involve extended periods of time at keyboard or workstation
• Tasks require the ability to perceive and hear sounds and see visual cues or signals
• Tasks require the ability to communicate orally

Benefits

All rates are bi-weekly.

2026 Rate Sheet - To view our rate sheet, please copy and paste this link into your web browser: https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:67382b58-4d1a-4519-89d7-8453f91e19a1

Life Insurance Employee Only (rates per $1,000 per month):

• Basic: Employer Paid

Optional Life Insurance Employee Only (rates per $1,000 per month)

• 25-29 $0.058
• 30-34 $0.083
• 35-39 $0.099
• 40-44 $0.132
• 45-49 $0.223
• 50-54 $0.363
• 55-59 $0.600
• 60-64 $0.795
• 65-69 $1.329
• 70 + $2.054

Important Perf Update

• For more information on eligibility options, refer to Proposal 21-288 https://bit.ly/3exq8yR
• All employees hired/rehired after 1/1/2022 have a choice to select the PERF Hybrid plan (3% + Pension) or the INPRS My Choice: Retirement Savings plan (3% + 1% Contribution). The Hybrid plan consists of two components:

Annuity Savings Account (ASA) -This consists of the mandatory employee contribution of three (3%) percent of compensation (made for the employee by the City), plus interest credits or earnings. You're always vested in your ASA portion - it's always yours.

Pension - The pension portion of the retirement benefit is funded by contributions made by the employer over the course of the employee's career and separate from the annuity savings account. Employees enrolled in the PERF Hybrid plan are eligible for retirement benefits at age sixty-five (65) if they have ten (10) or more years of creditable service. After June 30, 1995, employees may retire at age sixty (60) with at least fifteen (15) years of credible service or if the member's age in years plus the years of credible service equals at least 85 and the member is at least fifty-five (55) years of age. With fifteen (15) or more years of creditable service, the employee may retire as early as age fifty (50) with a reduced pension.

• Employees hired/rehired by the City and County between 1/1/2017 and 12/31/2021 will be automatically enrolled in the PERF My Choice: Retirement Savings plan. This plan is an annuity savings account (ASA) only plan and does not have a pension component. Any service that an employee has in the My Choice: Retirement Savings Plan will not count toward the service time requirements for pension eligibility in the Hybrid Plan.

With the PERF My Choice: Retirement Savings Plan, the ASA is split up into two parts:

Part one - This consists of the mandatory employee contribution of three (3%) percent of compensation (made for the employee by the City), plus interest credits or earnings. You're always vested in your ASA portion - it's always yours.

Part Two - This Consists Of An Additional Variable Rate Contribution Paid By The City Toward Your ASA. This Variable Rate Contribution Is Currently 1% Of Your Gross Wages. Vesting In The Value Of The Variable Rate Employer Contribution Will Vary By Length Of Participation. You Are

• 20 percent vested after 1 full year of participation
• 40 percent vested after 2 full years of participation
• 60 percent vested after 3 full years of participation
• 80 percent vested after 4 full years of participation
• 100 percent vested after 5 full years of participation
• All employees hired/rehired prior to 1/1/2017 are grandfathered into PERF Hybrid plan. The Hybrid plan consists of two components:

Annuity Savings Account (ASA) -This consists of the mandatory employee contribution of three (3%) percent of compensation (made for the employee by the City), plus interest credits or earnings. You're always vested in your ASA portion - it's always yours.

Pension - The pension portion of the retirement benefit is funded by contributions made by the employer over the course of the employee's career and separate from the annuity savings account. Employees enrolled in the PERF Hybrid plan are eligible for retirement benefits at age sixty-five (65) if they have ten (10) or more years of creditable service. After June 30, 1995, employees may retire at age sixty (60) with at least fifteen (15) years of credible service or if the member's age in years plus the years of credible service equals at least 85 and the member is at least fifty-five (55) years of age. With fifteen (15) or more years of creditable service, the employee may retire as early as age fifty (50) with a reduced pension.

• City Employees hired/rehired between 1/1/2017 and 12/31/21 that are members of the City AFSCME labor union can choose to enroll in either the PERF My Choice: Retirement Savings plan or the PERF Hybrid plan. Both plans are described above. Employees have 60 days to choose which option they want, and by state law this cannot be changed. If no choice is made, the employee will then be automatically added to the PERF My Choice: Retirement Savings plan.

The Indiana General Assembly has enacted a provision that allows public employees to make voluntary contributions in addition to the mandatory three percent (3%) contributions. Employees may contribute up to an additional ten- percent (10%) of their compensation per pay period to the annuity savings account. This means that the maximum level of contributions to the annuity savings account under this new provision is thirteen percent (13%) of an employee's compensation per pay period.

Employees who separate from the city within their first ten (10) years of employment need to contact INPRS - PERF regarding their ASA account.

Questions relating to PERF may be directed to INPRS - PERF at:

Indiana Public Retirement System

Public Employees' Retirement Fund

One North Capitol, Suite 001

Indianapolis, Indiana 46204

[phone]