Junior GRC Security Analyst

SUMMARY:

POSITION INFO:
Key Responsibilities
Governance & Control

• Support the maintenance of information security and ICT governance frameworks.
• Work with ISO 27001/27002 and NIST CSF frameworks.
• Maintain control mappings across multiple frameworks and regulations.
• Assist with reviewing and maintaining policies, standards and procedures.
• Collect, validate and maintain evidence for audits and regulatory reviews.

• Support ICT and information security risk assessments.
• Maintain risk registers, including inherent and residual risk ratings.
• Track remediation activities and control improvements through to completion.
• Provide risk input into technology changes, cloud initiatives, outsourcing and new systems or services.

• Support compliance with POPIA, GDPR, DORA and Joint Standard 2.
• Assist with data protection activities, DPIAs and breach documentation.
• Support ICT risk management, incident reporting and resilience requirements.
• Assist with regulatory submissions, compliance attestations and supervisory requests.
• Monitor regulatory changes and assist with impact assessments.

• Support ICT supplier and third-party risk assessments.
• Assist with due diligence, security questionnaires and evidence validation.
• Track supplier risks and remediation actions.
• Support regulatory requirements relating to critical and outsourced service providers.

• Support governance around cyber and ICT incident management.
• Assist with business continuity, disaster recovery and resilience activities.
• Support incident classification, documentation and regulatory reporting.
• Participate in post-incident reviews and track resulting control improvements.

• Support internal and external audits and regulatory examinations.
• Track audit findings and remediation actions.
• Prepare risk and compliance reporting for management and governance forums.

• Work closely with technical and business stakeholders to embed compliance by design.
• Translate regulatory and framework requirements into practical control expectations.
• Provide day-to-day GRC guidance to IT, Security, Cloud and business teams.

• 1–3 years’ experience in GRC, Information Security, Risk or Compliance.
• Experience within financial services or another highly regulated environment.
• Practical experience with:
• ISO/IEC 27001 & 27002
• NIST Cybersecurity Framework (CSF)
• Relevant NIST SP standards
• Experience with control mapping and evidence collection across multiple frameworks.
• Working knowledge of:
• POPIA / GDPR
• DORA
• Joint Standard 2 – Cybersecurity and Cyber Resilience
• Exposure to ICT risk, cyber risk or technology compliance.
• Experience supporting audit, regulatory or assurance activities.

• ISO/IEC 27001 Foundation, Implementer or Auditor certification.
• CGRC or similar GRC certification.
• Financial services, risk or compliance-related certifications.

• Exceptional attention to detail and strong documentation skills.
• Structured, analytical and risk-based approach.
• Strong written and verbal communication skills.
• Ability to engage confidently with both technical and non-technical stakeholders.
• High level of integrity, accountability and professionalism.
• Strong understanding of governance, risk and compliance principles.