Security GRC Analyst, Turnitin

• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience)
• 3+ years of experience in a role related to Information Security or Cybersecurity Compliance
• Professional certification such as CCSK, AWS Cloud Practitioner, or other related industry certification
• Familiarity with cybersecurity frameworks and regulatory standards such as NIST, SOC 2, TX-RAMP, and PCI DSS
• Familiarity of risk management and security best practices
• Experience with assessing security controls, risk mitigation strategies, and audit procedures
• Understanding of concepts related to AWS Cloud Infrastructure and security
• Experience conducting security impact analysis for system changes
• Experience conducting periodic internal security reviews or risk assessments to ensure that compliance procedures and technical configurations are followed
• Experience conducting third-party risk assessments
• Contract review experience for security requirements
• Highly organized and proactive individual capable of managing multiple responsibilities and delivering results

Desirable

• Turnitin is seeking an experienced Security GRC Analyst to join our Security & Compliance team
• The Sr Security GRC Analyst will be responsible for ensuring that our information and cloud systems comply with relevant regulatory frameworks, industry standards, and internal policies
• They will also collaborate with various departments, monitor compliance, conduct assessments, and support initiatives to identify and mitigate risks
• We are looking for someone who brings strong analytical ability, attention to detail, effective communication, compliance experience, and the willingness to continuously learn
• This role requires hands-on work, critical thinking and the ability to find new solutions for compliance
• This role reports to the GRC Information Security Manager
• Maintain compliance tracking capabilities to help ensure adherence with Turnitin’s security program and industry standards such as NIST CSF, NIST 800-53, SOC 2, TX-RAMP and PCI DSS
• Conduct risk and compliance assessments, audits, and risk evaluations to identify potential risk and compliance gaps
• Lead preparation and audit activities required to maintain our SOC 2 Type 2
• Collaborate with internal teams and external auditors for audit and compliance reviews
• Collaborate with sales and customer support teams to respond to security questionnaires and security posture questions from customers
• Support TPRM Program and conduct third-party risk assessments
• Complete user access reviews
• Administration of GRC platform
• Participate in the development and documentation of security policy, standards and processes to align with company information security strategy
• Provide security awareness and phishing training for employees and promote a culture of security and compliance
• Coordinate phish testing
• Collaborate with DevOps, IT, Legal, Engineering, People Team, and other departments to ensure security control and policy requirements are integrated into systems and business processes
• Provide input on ways to improve and automate team processes