Portfolio Jobs

The Challenge

We are looking for a dynamic Information Security GRC Analyst to support IT and InfoSec by performing various governance, risk, and compliance activities as part of the OneTrust InfoSec GRC team.

• Customer Security Assurance & Questionnaires
  
  
• • Own ahigh volume of end-to-end completion of customer security questionnaires (CAQs), RFP security sections, and other assurance artifacts (e.g., SIG, CAIQ, custom questionnaires).
  • Provide accurate, consistent, and defensible responses by leveraging internal evidence repositories (SOC reports, ISO certificates, policies, standards, diagrams, pen test summaries, etc.).
  • Partner with internal stakeholders (Sales, Marketing, Customer Success, Security, Engineering, Privacy, Legal, Compliance, Product) to validate responses and resolve gaps.
• Customer Engagement & Security Discussions
  • Meet with customers and prospects to explain security controls, risk posture, and compliance commitments.
  • Present security topics with confidence and clarity—tailoring depth for technical and non-technical audiences.
  • Support Sales and Customer Success by addressing security objections, clarifying customer audit scope, and enabling procurement cycles.
• Contract & Security Review
  • Perform security reviews of contracts, DPAs, security addenda, and customer security terms.
  • Identify security requirements, non-standard obligations, and risk areas; propose mitigations and collaborate with Legal and Security leadership on negotiation positions.
  • Track contractual security commitments and help ensure they are operationally feasible and aligned with control coverage.
• Operational Excellence
  • Improve team efficiency through standardization, playbooks, and continuous refinement of response libraries.
  • Demonstrated ability to manage, prioritize, and execute a high volume of concurrent requests with accuracy and consistency, while meeting SLAs and maintaining quality standards in a fast-paced environment.
  • Contribute to internal readiness by keeping evidence current, identifying control documentation gaps, and recommending process improvements.

You Are

• • 2-5 years of relevant experience in information security, security compliance, GRC, security assurance, third-party risk, or customer trust functions.
  • Demonstrated experience responding to customer security questionnaires and security due diligence requests.
  • Familiarity with common frameworks and attestations: SOC 2, ISO 27001, NIST, CIS, PCI DSS, HIPAA, GDPR, etc.
  • Strong understanding of security fundamentals (e.g., access control, encryption, vulnerability management, secure SDLC, incident response, logging/monitoring, vendor risk).
  • Experience collaborating cross-functionally (Security, Legal, Privacy, Engineering, Sales).
  • Excellent written and verbal communication skills—able to translate technical controls into clear, customer-ready responses.
  • Strong organizational skills and ability to manage multiple requests with competing deadlines.
• Preferred / Nice-to-Have
  • Industry certifications such as CISA and/or CISM (or equivalent).
  • Experience reviewing/negotiating security contract terms, security addendums, and customer assurance language.
  • Background in SaaS/cloud security assurance or supporting enterprise customers.
• Core Competencies
  • Customer-oriented mindset with the ability to maintain security rigor while enabling business outcomes.
  • Risk-based thinking—knows when to escalate, when to propose mitigations, and how to document decisions.
  • Attention to detail and commitment to consistency, defensibility, and evidence-based responses.
  • Comfort with ambiguity and strong ability to drive outcomes in a fast-paced environment.
  • High-Throughput Execution – Ability to efficiently manage and deliver a high volume of security assurance requests while maintaining quality, accuracy, and timeliness.
• What Success Looks Like (First 90 Days)
  • Independently handles a steady volume of questionnaires with high accuracy and improved cycle times.
  • Builds trusted partnerships with Legal/Privacy/Security to streamline approvals and escalations.
  • Leads customer security calls effectively and contributes to deal progression.
  • Establishes reusable response patterns and mentors junior staff to raise overall team quality.