GRC Analyst

ABOUT THE ROLE The Governance, Risk, and Compliance (GRC) Analyst is responsible for implementing the internal control review program for the Information Services Agency, which provides IT services to the city and county of Indianapolis and Marion County. Reporting to the CISO, this role ensures the organization adheres to regulatory requirements and internal policies through testing, monitoring, and oversight of various security reviews. KEY RESPONSIBILITIES - Ensure adherence to regulatory requirements and internal policies. - Monitor and stay current on CIS Benchmarks, NIST, CJIS, PCI, and other relevant standards, guidance, and policy. - Research and develop templates to support scalable assessment of vendors and solutions. - Manage third-party risk via a Vendor Risk Management program including assessments, monitoring, and management. - Build relationships with key agency partners and vendors to support collaborative assessments. - Track contractually obligated security deliverables for ISA contracts and collaborate to ensure compliance. - Manage risk and compliance register to guide strategic decision making and ensure compliance. - Support the Incident Manager during security incidents by completing documentation, root cause analysis, and problem review/resolution. - Collaborate with the Security Manager to ensure recurring security training includes relevant risk and compliance content. - Serve as compliance administrator to focus on regulatory compliance. - Monitor and track remediation efforts for compliance and security findings. - Develop reporting capabilities for all tracked items. - Collaborate with the team on data security controls including information protection. - Support ticket management in ServiceNow. - Collaborate on standards and documentation to support data governance and risk management. - Maintain confidentiality at all times. MINIMUM QUALIFICATIONS - Bachelor's degree in computer science, Information Systems, Information Technology, or a related field, or equivalent work experience. - At least 2-3 years of experience in governance, risk, and compliance roles. - Strong understanding of risk assessment methodologies and control frameworks such as COSO, COBIT, and NIST. - Experience with CIS Benchmarks, NIST, CJIS, PCI, and other relevant standards. - Familiarity with relevant platforms including Microsoft Security suite and ServiceNow. - Excellent analytical skills and attention to detail. - Strong verbal and written communication skills. - Ability to work independently and as part of a team. SPECIAL REQUIREMENTS - Preferred Education: Master's Degree in Computer Science, Data Science or Analytics, Law degree focused on Privacy, or a related field. - Preferred Certifications: Professional certifications such as CISA, CRISC, CISM, CISSP, or GRCP. - Working Conditions: Essential functions are regularly performed in an office setting without exposure to adverse environmental conditions. - Physical Conditions: Sitting at a desk the majority of the day, some lifting, carrying, pushing, and pulling of light weight objects (5-10 pounds), extended periods at a keyboard, ability to perceive and hear sounds and see visual cues, and ability to communicate orally. SELECTION PROCESS - If qualifications meet the requirements, the application will be referred to the hiring agency. - All further communication during the interview and selection process will be handled directly by the agency. - It is imperative to record the contact information of the individual scheduling the interview, as City-County HR will not have access to this information and is not involved in the interview or selection process. - After selection, an official offer of employment will be made by HR. HOW TO APPLY - Submit an application online through the City of Indianapolis and Marion County employment portal before the closing date. EMPLOYMENT DETAILS - Job Type: Full Time - Location: City County Building, 200 E. Washington Street, CCB 1501, Indianapolis, Indiana, 46204 - Department: Information Services Agency - Job Number: 09993 - Opening Date: 08/12/2026 - Closing Date: 11/12/2026 11:59 PM Eastern - Employer: City of Indianapolis and Marion County (Equal Opportunity Employer)