GRC Controls Analyst – Cybersecurity & Audit Readiness

TikTok USDS Joint Venture; New York (NY); On-site; USD 99,000 - 196,000; Full time

Job summary

TikTok USDS Joint Venture LLC is seeking a GRC Cybersecurity Controls Analyst to support the operation, testing, and improvement of the controls framework across ISO 27001, SOC 2, NIST CSF, PCI and related certifications.

The role collaborates with control owners, product, security, legal, and audits to evaluate control design, evidence, and operating effectiveness, and to drive automation of GRC processes in a fast-moving environment.

Qualifications

• Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Risk Management, Compliance, Engineering, Data Analytics, or related field, or equivalent practical experience.
• 3+ years of experience in GRC, IT risk, security controls, audit readiness, control testing, compliance, or related field.
• Experience gathering, reviewing, and assessing technical control evidence from stakeholders, systems, tools, dashboards, or documentation repositories.
• Working knowledge of ISO 27001, NIST CSF, SOC 2, PCI-DSS, or similar control frameworks.
• Familiarity with security domains such as IAM, Vulnerability Management, Incident Management, Data Security, SDLC, Privacy.
• Strong writing and documentation skills with ability to create clear control narratives and testing summaries.

Responsibilities

• Maintain and improve the controls framework, including control descriptions, mappings, owners, evidence expectations, testing procedures, and narratives.
• Perform control testing and validation: design, implementation, and operating effectiveness testing.
• Review evidence submitted by control owners to determine adequacy for audit or assessment.
• Coordinate with owners and stakeholders to resolve evidence gaps and improve testing quality.
• Support audits, certifications, and assessments (ISO 27001, SOC 2, PCI, NIST CSF).
• Support GRC automation by defining requirements for workflow automation and scalable testing processes.
• Work with engineering teams to understand data sources and opportunities to automate control validation.
• Contribute to high-quality documentation and defensible testing across the Controls & Certifications function.

Skills

GRC

Audit readiness

Control testing

Documentation

Stakeholder management

Security controls

ISO 27001 / NIST CSF

Cross-functional collaboration

Automation

Education

Bachelor’s degree in Information Security / Cybersecurity / IT / Risk/ Compliance

Tools

SQL

APIs

Data workflows

Automation tooling

Job description

TikTok USDS Joint Venture LLC is seeking a GRC Cybersecurity Controls Analyst to support the operation, testing, and improvement of the controls framework across ISO 27001, SOC 2, NIST CSF, PCI and related certifications.

The role collaborates with control owners, product, security, legal, and audits to evaluate control design, evidence, and operating effectiveness, and to drive automation of GRC processes in a fast-moving environment.