GRC Analyst - Remote, USA

Optiv; United States; Remote; USD 70,000 - 90,000; Full time

Job summary

Optiv is seeking a GRC Analyst to deliver governance, risk, and compliance support in a fully remote role across the continental U.S. You will handle access reporting, account reconciliation, audit-trail review, and evidence handling within a managed-services environment.

Working with control owners, auditors, and service leadership, you will follow approved systems and procedures, escalate exceptions, and help maintain traceable records and timely deliverables for assigned engagements.

Responsibilities

• Generate user access and permissions reports using approved systems and procedures.
• Reconcile inactive accounts across in-scope systems and document discrepancies.
• Maintain records of staffing, access rights, and changes affecting access reviews.
• Support elevated-access reviews and document statuses with risk/exceptions.
• Review system activity logs and audit trails per defined criteria.
• Archive security- and audit-related emails and records in approved repositories.
• Check evidence for completeness, accuracy, period, source, and retrievability.
• Maintain traceable records of source, status, disposition, owner, and dates.
• Complete compliance forms, trackers, attestations using approved data.
• Assist in preparing audit reports and necessary evidence.
• Explain escalation or completion of requests within priorities.
• Manage GRC and third-party risk workflow queues and tracking.
• Record scope, ownership, due dates, dependencies, and disposition.
• Monitor aging items and blockers; escalate as needed.
• Coordinate with stakeholders to clarify requests and avoid unapproved risk.

Job description

This position will be fully remote and can be hired anywhere in the continental U.S.

The GRC Analyst delivers recurring governance, risk, and compliance operational support within a managed-services environment. The role performs access reporting, account reconciliation, activity and audit-trail review, evidence handling, compliance tracking, audit support, and GRC and third-party risk workflow administration using approved systems, procedures, and review criteria.

This is a client-dedicated role assigned to support designated managed-services clients and their defined GRC service requirements. The role works in client-owned or client-approved systems during applicable client-aligned service windows established for assigned engagements.

This is an operational GRC delivery role accountable for accurate, timely, and traceable execution of assigned activities. The analyst supports control owners, risk owners, auditors, and service leadership while escalating exceptions and decisions outside assigned authority.

How you'll make an impact

Access, Account & Permissions Governance

• Generate user access and permissions reports using approved systems, report parameters, and procedures.
• Reconcile non-user and inactive accounts across in-scope systems; document discrepancies and route exceptions for review and resolution.
• Maintain records related to staffing, assigned duties, access, and changes that affect required access or control reviews.
• Support elevated-access reviews and exception handling by collecting records, maintaining status, updating approved risk register or exception records, and escalating unresolved items.

System Activity, Audit Trail & Evidence Review

• Review system activity logs and audit trails according to defined review criteria and schedules; document the review performed and route identified exceptions.
• Archive, organize, and review security- and audit-related email reports and associated records in approved repositories.
• Check assigned evidence for completeness, accuracy, applicable period, source, and retrievability before routing it for review.
• Maintain traceable records of source, review status, disposition, owner, exception, escalation, and completion date.

Compliance & Audit Support

• Complete compliance forms, review trackers, attestations, and supporting records using approved source information.
• Assist in preparing audit reports and supporting evidence needed for regulatory and other assigned reviews.
• Perform accuracy, completeness, consistency, and traceability checks before routing deliverables for review or submission.
• Respond to assigned evidence or information requests within established priorities; document completion, dependencies, and exceptions.

GRC & Third-Party Risk Workflow Support

• Manage report queues and request tracking for GRC and third-party risk workflows using approved systems and procedures.
• Record request scope, ownership, status, due dates, dependencies, disposition, and supporting documentation accurately and consistently.
• Monitor aging items, follow up for missing information, and escrow blockers, overdue requests, or matters outside assigned authority.
• Coordinate with stakeholders to clarify requests and support timely completion without independently performing a third-party risk assessment, approving a third party, or accepting risk unless specifically delegated.

Service Delivery, Quality & Information Handling

• Perform assigned work using client-owned or client-approved systems and platforms during applicable client-aligned service windows.
• Follow approved procedures, access restrictions, data-handling requirements, naming conventions, and evidence-retention practices.
• Protect confidential, security-sensitive, employee, and access-related information and immediately escape suspected handling or access issues.
• Prepare status and operational metrics for assigned work, including timeliness, aging, completion, exceptions, and quality.
• Identify recurring process or data-quality issues and recommend procedure clarifications without changing approved controls or processes without authorization.

Decision Authority & Accountability

• Execute assigned GRC activities within documented procedures, approved access, defined review criteria, and established service priorities.
• Make routine record-maintenance, queue-management, and evidence-organization decisions that comply with approved standards.
• Do not independently approve access or third parties, accept risk, interpret legal or regulatory requirements, design controls, determine control effectiveness, approve control exceptions, or make material process changes unless specifically delegated.
• Escalate suspected control failures, anomalous activity, unresolved reconciliation issues, missing audit evidence, access concerns, overdue work, and decisions outside assigned authority.

Core Competencies

Access reporting, account reconciliation, elevated-access review support, and exception tracking System activity, audit-trail,