InfoSec GRC Analyst: Risk & Compliance

Barnes & Thornburg LLP; Pennsylvania; On-site; USD 70,000 - 95,000; Full time

Job summary

Barnes & Thornburg LLP is seeking an Information Security GRC Analyst to join the Information Security team in Pennsylvania. You will help measure, prioritize, and maintain technology risks in the risk register, under the Governance Manager, analyzing and documenting risks across business operations.

You will assist with risk reporting to executive management and support ISMS/PIMS operations in line with ISO 27001/2019 standards, while coordinating with IT and business stakeholders.

Qualifications

• Bachelor’s degree or equivalent experience.
• 2 years of IT, risk management, or information security experience.
• Entry-level security certifications (e.g., Security+) preferred; CISSP/CISA desired.
• Familiarity with ISO 27001/27002 and SOC 2 Type II concepts.

Responsibilities

• Serve as a point of contact for IT and non-IT stakeholders on technology-related risk questions.
• Support risk assessments, policy management, and third‑party risk management.
• Help identify and maintain the Information Security Risk Register.
• Assist with risk reporting to executive management and management responses.
• Assist IT risk assessments for on‑premises and cloud infrastructure.
• Track exceptions and waivers to internal security standards.
• Support ISMS/PIMS operations in line with ISO 27001:2022 and ISO 27701:2019.
• Assist with responses to security audits and client RFP content.

Skills

Risk assessment

Policy governance

Communication skills

Analytical thinking

Data analysis in Excel

Education

Bachelor's degree or equivalent experience

Tools

Microsoft Project

Asana

Trello

Job description

Barnes & Thornburg LLP is seeking an Information Security GRC Analyst to join the Information Security team in Pennsylvania. You will help measure, prioritize, and maintain technology risks in the risk register, under the Governance Manager, analyzing and documenting risks across business operations.

You will assist with risk reporting to executive management and support ISMS/PIMS operations in line with ISO 27001/2019 standards, while coordinating with IT and business stakeholders.