What are the responsibilities and job description for the Governance Risk and Compliance Analyst position at FH Cann & Associates Inc.?
The GRC Analyst is responsible for supporting the Governance, Risk, and Compliance (GRC) program by ensuring adherence to regulatory requirements and standards, managing risk assessments, assisting and supporting audit and assessment activities and promoting best practices in information security, privacy and compliance. This role involves close collaboration with stakeholders across various departments to develop, implement, and maintain policies and procedures that support company objectives, regulatory compliance, and risk management.
Governance
- Support the development and maintenance of GRC frameworks, including policies, standards, and procedures to promote company-wide compliance and security best practices.
- Assist in establishing and maintaining the company’s control framework to meet industry standards and regulatory requirements.
- Participate in the company’s internal audit program, collect, analyze and categorize evidence.
Risk Management & Assessment
- Conduct regular risk assessments, identifying, evaluating, and managing risks to minimize operational and compliance risks in support of the Enterprise Risk Management program.
- Assist in the coordination of all internal and external audits and assessments such as SOC 1, SOC 2, NIST 800-53, and ISO 9001 QMS, ensuring control compliance and risk mitigation.
- Monitor risk mitigation efforts and report on key risk indicators.
Compliance
- Monitor and ensure compliance with relevant regulatory requirements and standards including but not limited to NIST SP 800-53, Gramm-Leach-Bliley Act (GLBA), PCI-DSS, CCPA, and other applicable federal and state privacy regulations.
- Contribute to the development of GRC training workshops and policy briefs to ensure awareness of GRC processes and audit preparation.
- Support internal and external audits by collecting and reviewing artifacts and evidence and providing necessary documentation.
Continuous Improvement
- Stay current with industry trends, regulatory updates, and best practices to proactively improve GRC processes.
- Identify opportunities for improvement to GRC tools, processes and functions and provide recommendations to management.
- Create and maintain positive relationships with internal and external entities.
