Information Security GRC Analyst

GP Strategies; United States; Remote; USD 120,000 - 160,000; Full time

Job summary

GP Strategies is seeking a hands-on Senior Security Analyst to bridge security operations and governance, risk, and compliance. The role focuses on telemetry, eDiscovery, third-party risk vetting, and patch remediation rather than strategy meetings.

The candidate will be the technical anchor for day-to-day security alerts, endpoint hygiene, and cloud posture, owning data governance workflows across Microsoft 365 and Google Workspace environments.

Qualifications

• Bachelors degree in Computer Science, Cybersecurity, IT, or equivalent hands-on experience.
• 5+ years of hands-on security admin, incident response, and technical GRC operations.
• Direct experience using Microsoft Purview and Google Workspace Vault for data holds and exports.
• Proficiency with Defender XDR (or similar) and log analysis.
• Hands-on experience with Tenable.io, Intune, and endpoint management solutions.
• Familiarity with Azure security controls and CIS Benchmarks.
• Ability to evaluate SaaS vendor security posture and risk.

Responsibilities

• Direct and manage data governance, eDiscovery, and GRC workflows for legal holds and audits.
• Monitor security alerts across Defender XDR, endpoints, identities, and cloud workloads.
• Oversee vulnerability management and remediation with IT teams.
• Audit Azure/AWS configurations against CIS Benchmarks and internal standards.
• Develop automated playbooks to streamline alert triage and routine tasks.

Skills

Security operations

GRC operations

eDiscovery

Incident response

Vulnerability management

Cloud security

Endpoint management

SIEM/XDR

Education

Bachelor's degree in CS/Cybersecurity/IT

Tools

Microsoft Purview

Google Workspace Vault

Tenable.io

Microsoft Intune

KACE SMA

Azure security controls

Job description

JD - Security/GRC

Role Overview

We are seeking a hands-on, highly technical Senior Security Analyst to bridge technical security operations and practical Governance, Risk, and Compliance (GRC). This role is ideal for a seasoned practitioner who thrives on execution , someone who prefers digging into telemetry, executing precise eDiscovery queries, evaluating third-party software risks, and driving patch remediation over sitting in high-level strategy meetings.

You will serve as the primary technical anchor for day-to-day security alerts, endpoint hygiene, cloud posture, and software vetting, while owning key data governance workflows across Microsoft 365 and Google Workspace envirienmfents.

Key Responsibilities

Data Governance, eDiscovery & GRC Operations

• Direct and perform technical search, export, preservation, and redaction workflows across Microsoft 365 (Purview) and Google Workspace Vault for legal hold, compliance, and privacy requests.
• Implement and monitor Data Loss Prevention (DLP) rules, sensitive data tags, and access controls to prevent unauthorized exposure of confidential data and PII.
• Partner with the Security Manager during internal and external compliance audits by extracting, validating, and presenting technical control evidence across cloud, endpoint, and identity systems.

Security Operations & Vulnerability Management

• Monitor and investigate security alerts across Microsoft Defender XDR, endpoints, identities, and cloud workloads, driving incident resolution through to root-cause post-mortems.
• Own routine vulnerability scanning via Tenable.io, working directly with IT/Infrastructure teams to enforce remediation SLAs and track exposure metrics.
• Oversee endpoint configuration compliance and patch deployment across Windows, macOS, and Linux using Microsoft Intune and Quest KACE SMA.
• Continuously audit Azure and AWS environments against CIS Benchmarks and internal hardening standards, remediating misconfigurations directly.
• Build and maintain practical automated playbooks and scripts to streamline routine alert triage and repetitive administrative security tasks.

Software & Emerging Tech Vetting

• Perform practical security vetting of all requested third-party software, SaaS applications, and API integrations, reviewing vendor SOC 2/ISO reports, permissions, and data handling practices before deployment.
• Evaluate third-party AI platforms, browser extensions, and agentic integrations to establish data privacy guardrails and mitigate shadow AI risks.

Technical Qualifications & Experience

• Bachelors degree in Computer Science, Cybersecurity, IT, or equivalent hands‑on professional experience.
• 5+ years of hands‑on experience in security administration, incident response, and technical GRC operations.
• Direct experience using Microsoft Purview and Google Workspace Vault for data holds, searches, and exports.
• Proficiency with Microsoft Defender XDR (or equivalent enterprise EDR/XDR suites) and log analysis.
• Hands‑on experience with Tenable.io, Microsoft Intune, and endpoint management solutions (e.g., KACE).
• Technical familiarity with Azure security controls, CIS Benchmarks, and basic cloud identity models.
• Demonstrated ability to evaluate SaaS vendor security posture, architectural risk, and software permission scopes objectively.

Preferred / Desirable Certifications

• ISC2 SSCP, CompTIA CySA+, or Cisco CCNA/CCNP Security.
• Azure Security Engineer Associate (AZ-500) or Microsoft Security Operations Analyst (SC-200).
• ISACA CRISC, CISA, or practical risk assessment training.

#Extra/Internal Notes only

• Focused on practical output, procedural rigour, and technical troubleshooting rather than high‑level slides or abstract theory.
• Capable of working directly with IT operations, legal teams, and business units to drive security hygiene without creating unnecessary friction.