GRC Analyst: Risk & Compliance Strategist

City of Indianapolis & Marion County; Indianapolis (IN); On-site; USD 70,000 - 100,000; Full time

Job summary

The City of Indianapolis & Marion County is seeking a Governance, Risk, and Compliance (GRC) Analyst to implement and oversee the internal control review program. The role focuses on testing, monitoring, and oversight of access reviews, vendor assessments, physical security reviews, and encryption/AV reviews, reporting to the CISO.

Responsibilities include aligning with CIS Benchmarks, NIST, and PCI standards, managing third‑party risk, and maintaining compliance across agencies.

Qualifications

• Bachelor’s degree in computer science, information systems, IT, or related field, or equivalent experience.
• 2–3 years of experience in governance, risk, and compliance roles.
• Understanding of risk assessment methodologies and control frameworks (COSO, COBIT, NIST).
• Experience with CIS Benchmarks, NIST, CJIS, PCI, and other standards.
• Familiarity with Microsoft Security suite and Service Now.

Responsibilities

• Ensure adherence to regulatory requirements and internal policies.
• Monitor CIS Benchmarks, NIST, CJIS, PCI, and other standards.
• Develop templates for scalable vendor assessments and support vendor risk management.
• Manage Vendor Risk Management program including assessments, monitoring, and management.
• Collaborate with agency partners and vendors to support assessments.
• Track compliance deliverables for ISA contracts and ensure compliance.

Skills

Analytical skills

Verbal and written communication

Attention to detail

Independent work

Team collaboration

Education

Bachelor's degree in computer science/IS/IT

Equivalent work experience

Master’s degree (preferred)

Tools

Microsoft Security suite

Service Now

Job description

The City of Indianapolis & Marion County is seeking a Governance, Risk, and Compliance (GRC) Analyst to implement and oversee the internal control review program. The role focuses on testing, monitoring, and oversight of access reviews, vendor assessments, physical security reviews, and encryption/AV reviews, reporting to the CISO.

Responsibilities include aligning with CIS Benchmarks, NIST, and PCI standards, managing third‑party risk, and maintaining compliance across agencies.