Hybrid GRC Analyst: Risk, Compliance & Security Strategy

beneschlaw; Cleveland (OH); Hybrid; USD 99,000 - 120,000; Full time

Benefits offered by this job

Hybrid schedule

Job summary

Benesch is hiring a GRC Analyst in Cleveland for a hybrid schedule. The role focuses on governance, risk, and compliance across the firm’s IT security program. You will support policy development, third-party risk, and audits in a professional services environment.

Ideal candidates have 6+ years in cybersecurity or GRC, experience with ISO 27001, CIS, NIST, and strong communication with stakeholders across business units.

Qualifications

• Bachelor's degree or equivalent with six+ years of experience in GRC or security
• Foundational understanding of cybersecurity principles and risk management; knowledge of frameworks such as ISO 27001, CIS and NIST
• Strong analytical, documentation, and stakeholder management abilities

Responsibilities

• Develops, maintains, and updates governance, risk, and compliance policies, standards, and procedures.
• Leads third-party risk management activities, vendor assessments, evidence review, and monitoring.
• Supports compliance efforts related to client obligations, external guidelines, and frameworks (ISO 27001, CIS, NIST CSF/800-53, GDPR, HIPAA, PCI).
• Develops security awareness programs and supports phishing simulations.
• Produces regular risk, compliance, and control reports using GRC tools.

Skills

Risk management

Documentation

Stakeholder management

Cybersecurity basics

ISO 27001 familiarity

NIST CSF familiarity

Security awareness understanding

Education

Bachelor's degree in Information Security / Cybersecurity / IT / Business

Tools

SIG

Archer

OneTrust

LogicGate

ZenGRC

Job description

Benesch is hiring a GRC Analyst in Cleveland for a hybrid schedule. The role focuses on governance, risk, and compliance across the firm’s IT security program. You will support policy development, third-party risk, and audits in a professional services environment.

Ideal candidates have 6+ years in cybersecurity or GRC, experience with ISO 27001, CIS, NIST, and strong communication with stakeholders across business units.