Senior Information Security & GRC Analyst

ARTSMARTUK LTD.; Cary (NC); On-site; USD 120,000 - 180,000; Full time

Job summary

Object Technology Solutions, Inc (OTSI) in Cary, NC, is seeking a Sr. Information Security Analyst – GRC for an onsite role to lead regulatory compliance and risk management, ensuring controls meet contractual and regulatory requirements.

Responsibilities include reviewing contracts for data security, supporting audits, developing policy standards, collecting evidence from control owners, and delivering risk metrics to leadership.

Qualifications

• Bachelor's degree in information systems, information security, or related field.
• 7–10 years of GRC experience with standards, frameworks and regulations.
• Experience supporting GRC for global companies.
• Strong risk assessment methodologies and frameworks.
• Ability to align policy, process, control design with regulatory standards.
• Collaborates with IT teams.
• Familiar with NIST CSF, ISO 27001, AICPA SOC.
• Knowledge of cyber and privacy laws.

Responsibilities

• Review client contracts for data security, breach reporting, and compliance clauses.
• Support audits with evidence of security policies and operations.
• Develop policy standards and enforce standards of practice.
• Collect KPI's and drive automation with DIT groups.
• Monitor regulatory landscape globally and update requirements.
• Coordinate third‑party risk assessments and vendor risk actions.
• Assist in security certification/attestations/audits.
• Provide data‑driven metrics to decision makers.

Skills

GRC execution

Regulatory compliance

Risk assessment

Policy development

Vendor risk management

Audit support

Stakeholder engagement

Education

Bachelor's degree in information systems or information security

Tools

ServiceNow

GRC platforms

Job description

Object Technology Solutions, Inc (OTSI) in Cary, NC, is seeking a Sr. Information Security Analyst – GRC for an onsite role to lead regulatory compliance and risk management, ensuring controls meet contractual and regulatory requirements.

Responsibilities include reviewing contracts for data security, supporting audits, developing policy standards, collecting evidence from control owners, and delivering risk metrics to leadership.