Technology Risk Analyst

Overview

This role (Analyst Level III/IV) reports into Technology GRC leadership and focuses on Policy Exception Management and Metrics & Monitoring. The GRC Analyst executes defined processes, gathers and validates evidence, and produces recurring metrics and reporting under the guidance of senior team members.

The role works alongside AI agents in a human-in-the-loop model, using AI-assisted workflows to streamline exception intake, evidence collection, and metrics production while reviewing results for accuracy.

Responsibilities

Policy Exception Management

• Operate the policy exception intake process, ensuring exceptions are logged, risk-rated, time-bound, and routed for appropriate approval.
• Track exception status and maintain alignment to approved policies and standards to support regulatory defensibility.
  
  

Metrics & Monitoring

• Collect, validate, and produce recurring GRC metrics (KRIs, KCIs, KPIs) and dashboards that provide visibility into risk posture, remediation progress, and compliance health.
• Support trend analysis and prepare inputs for governance and committee reporting.
  
  

AI-Augmented Delivery

• Use AI-assisted workflows (human-in-the-loop) to streamline exception processing, evidence collection, and metrics production, reviewing outputs for accuracy.
  
  

Evidence Collection & Compliance Support

• Collect and validate control evidence, support audit requests, and help track compliance obligations and remediation tasks across frameworks (SOC 2, PCI DSS, SOX ITGC).
• Maintain accurate documentation in the GRC platform to support audit-ready reporting.
  
  

Qualifications

• - Bachelor's degree in Information Technology, Cybersecurity, Risk Management, Business, or a related field, or equivalent experience.
• Minimum 2+ years in GRC, IT audit, compliance, or a related analytical role.
• Working knowledge of policy/exception processes and metrics or reporting production.
• Comfort using AI-assisted tools to support data gathering and documentation, with attention to validating output.
• Familiarity with NIST CSF 2.0, COBIT 2019, and COSO ERM concepts.
• Strong attention to detail, organization, and written communication.
• Progress toward relevant certifications a plus (e.g., CRISC, CISA).
• Exposure to GRC tooling (e.g., ServiceNow IRM, AuditBoard, Vanta, Drata) and evidence collection.
• Foundational knowledge of compliance frameworks (SOC 2, PCI DSS, ISO 27001) and control concepts; CompTIA Security+ or progress toward GRC certifications a plus.
• Preferred experience in the Property Management, Multifamily Housing, SaaS, FinTech, or PropTech industries.