GRC Cyber Controls Analyst: Audit Readiness & Automation

TikTok USDS Joint Venture; New York (NY); On-site; USD 99,000 - 196,000; Full time

Job summary

TikTok USDS Joint Venture LLC is seeking a GRC Cybersecurity Controls Analyst to join the GRC Controls & Certifications team. This role supports control testing, evidence review, audit response coordination, and narrative development across ISO 27001, SOC 2, NIST CSF, PCI and related obligations.

You will collaborate with control owners, product teams, security, privacy, legal, internal and external auditors, and GRC leadership to evaluate control design and operating effectiveness, while

Qualifications

• Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Risk Management, Compliance, Engineering, Data Analytics, or a related discipline, or equivalent practical experience.
• 3+ years of experience in GRC, IT risk, security controls, audit readiness, control testing, compliance, security assurance, or a related field. Experience performing or supporting control testing, including evaluating control design, implementation, and operating effectiveness.
• Experience gathering, reviewing, and assessing technical control evidence from stakeholders, systems, tools, dashboards, or documentation repositories. Working knowledge of security and compliance frameworks such as ISO 27001, NIST CSF, SOC 2, PCI-DSS, or similar control frameworks.
• Familiarity with security domains such as Identity and Access Management, Vulnerability Management, Incident Management, Asset Management, Logging and Monitoring, Data Security, SDLC, Third-Party Risk Management, Business Continuity / Disaster Recovery, or Privacy.
• Strong writing and documentation skills, with the ability to create clear control narratives, evidence and testing summaries, and status updates. Strong analytical skills and ability to assess whether evidence meets the intent of a control, requirement, or audit request.
• Experience working with control owners, technical teams, auditors, legal, privacy, compliance, or cross-functional stakeholders. Ability to manage multiple workstreams, follow up on open items, identify blockers, and communicate risks clearly. Demonstrated teamwork and collaboration skills, especially in fast-moving, cross-functional environments.

Responsibilities

• Support the maintenance and continuous improvement of the controls framework, including control descriptions, mappings, owners, evidence expectations, testing procedures, and control narratives.
• Perform control testing and validation activities, including design, implementation, and operating effectiveness testing.
• Review evidence submitted by control owners and product teams to determine whether it sufficiently demonstrates control performance and meets audit or assessment expectations.
• Coordinate with control owners, evidence owners, product teams, and GRC stakeholders to resolve evidence gaps, clarify control intent, and improve testing quality.
• Support internal and external audits, certifications, and assessments, including ISO 27001, SOC 2, PCI, NIST CSF, and other GRC obligations.
• Support GRC automation initiatives by helping define requirements for workflow automation, control monitoring, and scalable control testing processes.
• Work with technical and engineering teams to understand security tools, data sources, system-generated evidence, and opportunities to automate or improve control validation.
• Contribute to a culture of high-quality documentation, defensible controls testing, and continuous improvement across the Controls & Certifications function.

Skills

GRC basics

Audit readiness

Control testing

ISO 27001

SOC 2

NIST CSF

PCI-DSS

Documentation

GRC automation

Education

Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Risk Management, Compliance, Engineering, Data Analytics, or related discipline

Tools

SQL

APIs

Scripting

Dashboards

Job description

TikTok USDS Joint Venture LLC is seeking a GRC Cybersecurity Controls Analyst to join the GRC Controls & Certifications team. This role supports control testing, evidence review, audit response coordination, and narrative development across ISO 27001, SOC 2, NIST CSF, PCI and related obligations.

You will collaborate with control owners, product teams, security, privacy, legal, internal and external auditors, and GRC leadership to evaluate control design and operating effectiveness, while