GRC Controls Analyst: Audit-Ready & Automation

TikTok USDS Joint Venture; San Jose (CA); On-site; USD 99,000 - 196,000; Full time

Job summary

TikTok USDS Joint Venture LLC is seeking a GRC Cybersecurity Controls Analyst to join the GRC Controls & Certifications team. This role supports the operation, testing, and continuous improvement of the controls framework and helps drive audit readiness across security, privacy, and regulatory obligations.

You will work with control owners, product teams, security, privacy, legal, and internal/external auditors to evaluate control design and effectiveness, support ISO 27001, SOC 2, PCI, and NIST

Qualifications

• Bachelor’s degree in Information Security, Cybersecurity, IT, Risk Management, Compliance, Engineering, Data Analytics, or related field.
• 3+ years in GRC, IT risk, security controls, audit readiness, or related
• Experience gathering, reviewing, and assessing technical control evidence from stakeholders, systems, tools, dashboards, or documentation repositories
• Familiarity with ISO 27001, SOC 2, PCI-DSS, NIST CSF or similar control frameworks
• Strong writing, documentation, and ability to produce clear control narratives and testing summaries

Responsibilities

• Support maintenance and continuous improvement of the controls framework, including control descriptions, mappings, owners, evidence expectations, testing procedures, and narratives.
• Perform control testing and validation across design, implementation, and operating effectiveness.
• Review evidence submitted by control owners and product teams for audit readiness.
• Coordinate with control owners, product teams, and stakeholders to resolve evidence gaps and improve testing quality.
• Support audits, certifications, and assessments such as ISO 27001, SOC 2, PCI, NIST CSF.
• Assist with GRC automation, workflows, and scalable testing processes.
• Collaborate with engineering teams to understand security tools and data sources for evidence.
• Contribute to high-quality documentation and defensible controls testing across the function.

Skills

Bachelor's degree, InfoSec

GRC experience

ISO 27001 / SOC 2 / PCI / NIST CSF

Evidence collection & dashboards

Documentation & writing

Education

Bachelor’s degree in Information Security or related field

Job description

TikTok USDS Joint Venture LLC is seeking a GRC Cybersecurity Controls Analyst to join the GRC Controls & Certifications team. This role supports the operation, testing, and continuous improvement of the controls framework and helps drive audit readiness across security, privacy, and regulatory obligations.

You will work with control owners, product teams, security, privacy, legal, and internal/external auditors to evaluate control design and effectiveness, support ISO 27001, SOC 2, PCI, and NIST