GRC Cybersecurity Analyst

Request Technology, LLC; Chicago (IL); Hybrid; USD 110,000 - 180,000; Full time

Job summary

Request Technology, LLC is seeking a seasoned Information Security professional to lead responses to client security assessments, questionnaires, and audits, and to document evidence and risk findings. You will create and maintain security policies, standards, guidelines, and supporting documentation while guiding IT risk, compliance, and governance across the organization.

The role also oversees vendor risk management, security exceptions, and the Security Awareness program, requiring clear

Qualifications

• Bachelor's degree or equivalent with 5 years of IT security experience.
• CISSP, CISA, CISM or equivalent certifications preferred.
• 4+ years in Information Security with hands-on technical experience.
• Strong knowledge of ISO 27001, NIST, SOC, SIG frameworks.
• Experience in AI governance, security, and risk management.
• Ability to communicate complex topics to varied audiences.

Responsibilities

• Lead responses to client security assessments, questionnaires, and audits.
• Create, maintain, and evolve security policies, standards, and guidelines.
• Manage IT security programs ensuring compliance across the organization.
• Advise stakeholders on security topics as an SME.
• Oversee third-party security vendor risk management program.
• Oversee security exception process and risk treatment guidance.
• Lead Security Awareness program lifecycle and evaluation.
• Support and optimize GRC platforms and workflows.
• Evaluate IT programs for alignment with security standards.

Skills

IT Security

Risk assessment

Security governance

Policy writing

Stakeholder communication

Vendor risk management

Education

Bachelor's degree

Tools

GRC platforms

SIEM

Job description

***We are unable to sponsor as this is a permanent full-time role***

***Hybrid, 3 days onsite, 2 days remote***

Responsibilities:

• Lead responses to client security assessments, questionnaires, and audits, documenting evidence and performing risk assessments as needed.
• Create, maintain, and evolve security policies, standards, guidelines, and supporting documentation through strong technical writing.
• Manage and support processes that ensure Information Technology (IT) systems meet cybersecurity, risk, and compliance requirements.
• Serve as an Information Security subject matter expert, advising technical and non-technical stakeholders across the organization.
• Manage the third-party Security Vendor Risk Management program, including assessments, remediation tracking, and lifecycle oversight.
• Oversee the security exception request process and provide guidance on appropriate risk treatment decisions.
• Manage the full lifecycle of the Security Awareness program, including roadmap development, training evaluation, and effectiveness measurement.
• Support and optimize Governance, Risk, and Compliance (GRC) technology platforms and associated workflows.
• Conduct evaluations of IT programs and components to confirm alignment with published security standards and frameworks.

Qualifications:

• Bachelor's degree or equivalent with five (5) years of work experience in IT Security is required.
• Certified Information Systems Security Professional (CISSP), Certified Information Security Auditor (CISA), Certified Information Security Manager (CISM), Advanced in AI Audit (AAIA), Advanced in AI Risk (AAIR), Advanced in AI Security Management (AAISM) or other relevant training and certifications are preferred.
• Four (4) or more years of Information Security experience, with hands on technical experience strongly preferred.
• Strong working knowledge of security frameworks and standards such as ISO 27001, National Institute of Standards and Technology (NIST), System and Organization Controls (SOC), and Standardized Information Gathering (SIG) is required.
• Experience in Artificial Intelligence (AI) governance, security, and risk management is required.
• Proven ability to produce clear, well-structured security documentation and communicate complex technical topics to varied audiences.
• Experience leading risk assessments, vendor security reviews, and client-facing security discussions with professionalism and tact.
• Familiarity with GRC platforms, role-based access controls, and a broad range of security technologies and tools.
• Working knowledge of areas such as authentication, encryption, firewalls, SIEM, intrusion detection/prevention, vulnerability management, mobile security, and privileged access management.