Security GRC Analyst: Mitigate Risk & Elevate Compliance

Socket.dev; United States; Remote; USD 90,000 - 120,000; Full time

Benefits offered by this job

Health insurance

401(k) with company match

Paid time off

Job summary

Protective seeks a Security Risk Analyst to enhance our Information Security Risk Management program. You will perform risk assessments, maintain security policies, and support compliance initiatives across teams.

The role requires strong analytical skills and clear communication to drive improvements. Responsibilities include coordinating with compliance, legal, and technology teams, delivering risk metrics to leadership, and promoting security awareness through training and phishing

Qualifications

• Bachelor’s degree in cybersecurity, information systems, or related field.
• 1–3 years of experience in GRC, risk management, or compliance within cybersecurity.
• Familiarity with regulatory frameworks, audit processes, and control environments.

Responsibilities

• Perform and mature enterprise risk assessments using NIST CSF, NIST 800-53, SOC 2, and CIS.
• Analyze vulnerability assessment reports to support remediation and risk reduction.
• Develop and execute security awareness programs and phishing simulations.
• Deliver actionable reporting and insights including dashboards and executive summaries.
• Conduct end‑to‑end third‑party risk assessments and vendor lifecycle activities.

Skills

GRC

Regulatory frameworks

TPRM

Security metrics

Vulnerability management

Communication

Agile

Education

Bachelor’s degree in Cybersecurity

Tools

ServiceNow

Archer

SharePoint

Power BI

UpGuard

Azure

AWS

Job description

Protective seeks a Security Risk Analyst to enhance our Information Security Risk Management program. You will perform risk assessments, maintain security policies, and support compliance initiatives across teams.

The role requires strong analytical skills and clear communication to drive improvements. Responsibilities include coordinating with compliance, legal, and technology teams, delivering risk metrics to leadership, and promoting security awareness through training and phishing