Information Security GRC Analyst

Barnes & Thornburg LLP

. Support the firm’s technology risk management policies, procedures, and guidelines .

Posted 10/26/2026full-timePhiladelphia • Pennsylvania • United StatesJuniorMid-LevelWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in IT Risk Management and Information Security, with a strong focus on ISO 27001 and security governance frameworks. Proficient in risk assessment methodologies, security policy management, and vendor security evaluations.

Highest-signal resume keywords

ISO 27001 ISMS OperationsIT Risk AssessmentsCompTIA Security+Security GovernanceMicrosoft Office Suite

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

IT Risk ManagementInformation SecurityRisk Assessment MethodologiesSecurity Policy ManagementNetwork ProtocolsData AnalysisCybersecurity PrinciplesSecurity AuditsVendor Security ReviewsBusiness Continuity Planning

Soft Skills

Analytical SkillsProblem-Solving AbilitiesOrganizational SkillsCommunication SkillsAttention to Detail

Tools & Technologies

Microsoft ProjectAsanaTrelloExcelSecurity Technologies

Certifications & Qualifications

CompTIA Security+ISC2 Certified in CybersecurityCISSPCISA

Industry Keywords

ISO 27000 SeriesSOC 2 Type IIIT InfrastructureApplication DevelopmentSecurity Awareness Program

Tech Stack

Tools & technologies

CloudCyber SecuritySMTPTCP/IP

About the role

Key responsibilities & impact

Support the firm’s technology risk management policies, procedures, and guidelines
Analyze, document, prioritize, and track technology risks in the Information Security Risk Register
Serve as a point of contact for IT and non-IT stakeholders on technology-related risk questions
Support risk assessments, security policy and documentation management, third-party risk management, and ISO 27001 ISMS operations
Assist with periodic risk reporting to executive management and document management responses to identified risks
Assist with IT risk assessments for on-premises and cloud-based infrastructure, platforms, applications, and technology services
Help assess risks associated with major IT changes and technology implementations
Track and process exceptions and waivers related to internal security standards and related controls
Help integrate security controls into Business Continuity/Disaster Recovery planning
Assist with operation of the ISMS and PIMS in alignment with ISO 27001:2022 and ISO 27701:2019
Track and maintain security control requirements from ISO 27001 annex controls, client requirements, legal/regulatory guidelines, and other frameworks
Assist with security audits, questionnaires, client assessments, RFPs, and vendor agreements
Analyze business and IT processes from an information security perspective and identify improvements
Review and update security policies and procedures
Support the Security Awareness Program, including curriculum development, training content, delivery schedules, and participation monitoring
Assist with assessments of IT vendor relationships and security reviews of vendor agreements
Perform other information security duties as assigned

Requirements

What you’ll need

Bachelor’s degree or equivalent experience
2 years of relevant experience in IT, Risk Management, or Information Security; internships or academic coursework may be considered
Entry-level security or IT certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or similar preferred
Interest in pursuing advanced certifications such as CISSP or CISA
Familiarity with IT risk and threat assessment methodologies
Exposure to or familiarity with security governance, compliance, or control frameworks, including ISO 27000 series and SOC 2 Type II
Familiarity with IT security policies, procedures, and standards
Technical knowledge in at least one area such as IT infrastructure, systems engineering, networking, or application development
Familiarity with operating systems, application architectures, and security technologies
Working knowledge of network and security protocols, including TCP/IP, SMTP, FTP, SSH, TLS, SSL, HTTP, IPSec, and other VPN protocols
Basic understanding of networks, systems, databases, and foundational cybersecurity principles
Strong proficiency in Microsoft Office Suite, with advanced Excel skills for data analysis, tracking, and reporting
Ability to work in a fast-paced and demanding environment and respond to shifting priorities while meeting deadlines
Excellent oral and written communication skills
Strong analytical and problem-solving abilities
Strong organizational skills and attention to detail
Ability to maintain confidentiality and discretion of sensitive information
Ability to work collaboratively and, with guidance, independently
Eagerness to learn and develop GRC skills
Familiarity with project management tools such as Microsoft Project, Asana, or Trello preferred
Ability to perform essential duties satisfactorily, with or without reasonable accommodations

Benefits

Comp & perks

The firm will provide benefits to applicants and employees without regard to protected characteristics, as stated in its equal employment opportunity policy