GRC Analyst

City of Indianapolis & Marion County; Indianapolis (IN); On-site; USD 70,000 - 100,000; Full time

Job summary

The City of Indianapolis & Marion County is seeking a Governance, Risk, and Compliance (GRC) Analyst to implement and oversee the internal control review program. The role focuses on testing, monitoring, and oversight of access reviews, vendor assessments, physical security reviews, and encryption/AV reviews, reporting to the CISO.

Responsibilities include aligning with CIS Benchmarks, NIST, and PCI standards, managing third‑party risk, and maintaining compliance across agencies.

Qualifications

• Bachelor’s degree in computer science, information systems, IT, or related field, or equivalent experience.
• 2–3 years of experience in governance, risk, and compliance roles.
• Understanding of risk assessment methodologies and control frameworks (COSO, COBIT, NIST).
• Experience with CIS Benchmarks, NIST, CJIS, PCI, and other standards.
• Familiarity with Microsoft Security suite and Service Now.

Responsibilities

• Ensure adherence to regulatory requirements and internal policies.
• Monitor CIS Benchmarks, NIST, CJIS, PCI, and other standards.
• Develop templates for scalable vendor assessments and support vendor risk management.
• Manage Vendor Risk Management program including assessments, monitoring, and management.
• Collaborate with agency partners and vendors to support assessments.
• Track compliance deliverables for ISA contracts and ensure compliance.

Skills

Analytical skills

Verbal and written communication

Attention to detail

Independent work

Team collaboration

Education

Bachelor's degree in computer science/IS/IT

Equivalent work experience

Master’s degree (preferred)

Tools

Microsoft Security suite

Service Now

Job description

Job Summary

The Governance, Risk, and Compliance (GRC) Analyst is responsible for implementing the internal control review program. This includes testing, monitoring, and oversight of periodic access reviews, vendor assessments, physical security reviews, encryption/AV reviews, and more. The role involves ensuring that the organization adheres to regulatory requirements and internal policies, and it requires a keen eye for detail and strong analytical skills. Position reports to the CISO.

Agency Summary

The purpose and mission of the Information Services Agency provides information technology services to the city and county. It helps each of the city and county agencies and departments achieve their mission through technology solutions. Information Services Agency aligns its objectives with the business of city and county partners to provide accessible and reliable services to residents, businesses, and visitors. The agency can do this by cultivating a productive, collaborative, and compliant work environment for our workforce to meet the needs of the residents of Indianapolis and Marion County.

Equal Employment Opportunity

The City of Indianapolis Marion County is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status. We value diversity in perspectives and experiences among colleagues and the residents of this city of whom we serve.

Responsibilities

• Ensure adherence to regulatory requirements and internal policies.
• Monitor and stay current on CIS Benchmarks, NIST, CJIS, PCI, and other relevant standards, guidance, and policy.
• Research and develop templates to support scalable assessment of vendors, solutions, etc.
• Manage Third party risk via a Vendor Risk Management program including assessments, monitoring and management.
• Build relationships with key agency partners and vendors to support collaborative assessments.
• Track contractually obligated security deliverables for ISA contracts and collaborate to ensure compliance.
• Manage risk and compliance register to guide strategic decision making and ensure compliance.
• In the event of a security incident, support Incident Manager in completing documentation, to include root cause analysis and subsequence problem review and resolution.
• Collaborate with Security Manager to ensure recurring security training includes relevant risk and compliance content.
• Serve as compliance administrator to focus on regulatory compliance.
• Monitor and track remediations efforts for compliance and security findings.
• Develop reporting capabilities for all tracked items
• Collaborate with team on data security controls including information protection.
• Support ticket management in Service Now
• Collaborate on standards and documentation to support data governance and risk management.
• Must maintain confidentiality at all times.

This list of duties and responsibilities is not intended to be all-inclusive and may be expanded to include other duties or responsibilities that management may deem necessary from time to time.

Minimum Job Requirements and Qualifications

• Bachelor’s degree in computer science, Information Systems, Information Technology, or a related field, or equivalent work experience.
• · At least 2-3 years of experience in governance, risk, and compliance roles.
• Strong understanding of risk assessment methodologies and control frameworks (e.g., COSO, COBIT, NIST)
• Experience with CIS Benchmarks, NIST, CJIS, PCI, and other relevant standards.
• Familiarity with relevant platforms including Microsoft Security suite, Service Now.
• Excellent analytical skills and attention to detail.
• Strong verbal and written communication skills.
• Ability to work independently and as part of a team.

Preferred Job Requirements and Qualifications

• Master’s Degree in Computer Science, Data Science or Analytics, Law degree focused on Privacy, or a related field.
• Professional certifications such as CISA, CRISC, CISM, CISSP, or GRCP

Essential Functions

Essential functions are regularly performed in an office setting without exposure to adverse environmental conditions.

Physical Conditions

1. Sitting at a desk the majority of the day
2. Some lifting, carrying, pushing and/or pulling of objects and materials of light weight (5-10) pounds
3. Tasks may involve extended periods of time at keyboard or workstation
4. Tasks require the ability to perceive and hear sounds and see visual cues or signals
5. Tasks require the ability to communicate orally