{"id":3288989,"url":"https://alion.io/job/barnes-thornburg-information-security-grc-analyst","title":"Information Security GRC Analyst","company":{"id":4682,"name":"Barnes & Thornburg","domain":"btlaw.com","url":"https://alion.io/company/btlaw","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":84,"open_postings":14,"ghost_share":0,"stale_share":0.643,"repost_share":0,"time_to_fill_p50_days":42,"computed_at":"2026-10-27T05:46:45Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Philadelphia, United States","Indianapolis, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":109000,"max_usd":225000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":344},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Asana","optional":false},{"name":"ISO 27001","optional":false},{"name":"Microsoft Office","optional":false},{"name":"Microsoft Project","optional":false},{"name":"Outlook","optional":false},{"name":"SOC 2","optional":false},{"name":"TCP/IP","optional":false},{"name":"Trello","optional":false},{"name":"VPN","optional":false}],"status":"live","first_seen_at":"2026-10-26T17:55:47Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-10-27T18:16:12Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Summary: As a member of the Information Security team, the Information Security GRC Analyst supports the firm’s technology risk management policies, procedures, and guidelines. This role helps ensure that technology risks are measured, prioritized, and appropriately maintained in the risk register. Working under the direction of the Information Security Governance Manager, the GRC Analyst will help analyze, document, and track risks related to business operations, and will support the monitoring and improvement of risk management processes.\nKey Responsibilities:\nServe as a point of contact for IT and non-IT stakeholders on technology-related risk questions, escalating issues to senior team members and management as appropriate.\n\nSupport other professionals in technology risk management, covering areas such as risk assessments, security policy and documentation management, third-party risk management, and ISO 27001 ISMS operations.\n\nHelp identify and assess technology-related risks and maintain the Information Security Risk Register.\n\nAssist with periodic risk reporting to executive management, documenting management’s response to identified risks.\n\nAssist with IT Risk Assessments for on-premises and cloud-based infrastructure, platforms, applications, and key technology services, in line with IT Risk Management Methodology.\n\nHelp assess the risks associated with major IT changes and technology implementations.\n\nTrack and process exceptions and waivers related to internal security standards, unapproved software, web/email content filtering, password policies, etc.\n\nWork with IT Infrastructure to help ensure that security controls are integrated into Business Continuity/Disaster Recovery planning, ensuring the continuity of security controls where applicable.\n\nAssist with the operation of the Information Security Management System (ISMS) and Privacy Information Management System (PIMS) in alignment with ISO 27001:2022 and ISO 27701:2019 standards.\n\nTrack and maintain security control requirements from various sources, including ISO 27001 annex controls, client requirements, legal/regulatory guidelines, and other relevant frameworks.\n\nAssist in responding to security audits, questionnaires, and assessments from clients and external parties, supporting marketing and procurement teams with security-related content for client RFPs and vendor agreements.\n\nHelp analyze business and IT processes from an information security perspective and identify potential improvements.\n\nReview policies and procedures to help ensure security control requirements are adequately covered, suggesting updates and improvements as necessary.\n\nSupport the periodic review and update of security policies in accordance with firm guidelines.\n\nSupport the Security Awareness Program, including assisting with planning and curriculum development.\n\nAssist with content creation and delivery schedules for both broad and targeted security training.\n\nMonitor and report on participation in the awareness program, helping to address any compliance issues.\n\nAssist with periodic assessments of IT vendor relationships, helping ensure that third-party risk management issues are resolved and tracked.\n\nAssist with security reviews of vendor agreements in coordination with the Procurement and Legal teams.\n\nAdditional Responsibilities:\nPerform other duties related to information security as assigned.\n\nThe employee must be able to perform all essential job duties and responsibilities of this position satisfactorily and as outlined, with or without reasonable accommodations. Reasonable accommodation requests may be accommodated, absent undue firm hardship.\nQualifications:\nBachelor’s degree or equivalent experience.\n\n2 years of relevant experience in IT, Risk Management, or Information Security; internships or academic coursework may be considered.\n\nEntry-level security or IT certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or similar preferred; interest in pursuing advanced certifications such as CISSP or CISA.\n\nFamiliarity with IT risk and threat assessment methodologies.\n\nExposure to or familiarity with security governance, compliance, or control frameworks, including ISO 27000 series, SOC 2 Type II.\n\nFamiliarity with IT security policies, procedures, and standards.\n\nTechnical knowledge in at least one area such as IT infrastructure, systems engineering, networking, or application development.\n\nFamiliarity with operating systems, application architectures, and security technologies.\n\nWorking knowledge of network and security protocols, including TCP/IP, SMTP, FTP, SSH, TLS, SSL, HTTP, IPSec, and other VPN protocols.\n\nBasic understanding of IT concepts such as networks, systems and databases, as well as foundational cybersecurity principles (e.g. risk management, threat management, vulnerability assessments).\n\nStrong proficiency in Microsoft Office Suite (Excel, PowerPoint, Word, Outlook) with advanced skills in Excel for data analysis, tracking and reporting.\n\nAbility to work in a fast-paced and demanding environment and respond to shifting priorities while meeting deadlines.\n\nExcellent oral and written communication skills; must be able to articulate issues and information accurately, clearly and succinctly.\n\nStrong analytical and problem-solving abilities needed to address complex questions and issues.\n\nMust have strong organizational skills and be extremely detail-oriented; attention to detail, high-level of accuracy, issue-tracking, follow-up and resolution skills are essential.\n\nAbility to maintain confidentiality and discretion of sensitive information.\n\nAbility to work collaboratively and, with guidance, independently; eagerness to learn and develop GRC skills.\n\nFamiliarity with project management tools (e.g. Microsoft Project, Asana, Trello) preferred.\n\nWorking Conditions:\nNormal office environment with little exposure to excessive noise, dust, temperature and the like.\n\nSpecific work hours for this position will be assigned; generally, core business hours. The requirements may vary occasionally, depending on the needs of the Firm.\n\nThe above is intended to describe the general content of and requirements for the performance of this job. It is not to be construed as an exhaustive statement of essential functions, responsibilities or requirements.Subject to firm needs, duties and responsibilities of this position may change at any time, on a temporary or permanent basis, and with or without notice.\nEqual Employment and Opportunity Statement:\nBarnes & Thornburg is committed to equal employment opportunity in both principle and as a matter of policy. We will recruit, hire, train, promote, compensate and provide benefits to all applicants and employees without regard to ancestry, sex, race, color, ethnicity, national origin, gender, age, religion, religious creed, mental and/or physical disability, medical condition, military and/or veteran’s status, genetic information, marital status, sexual orientation, gender identity and/or expression, or any other basis protected by applicable federal, state and local laws. This policy applies to all recruiting, hiring, promotions, upgrades, layoffs, compensation, benefits, terminations and all other privileges, terms and conditions of employment. The firm complies fully with all federal, state and local equal employment opportunity laws.","description_format":"text","description_chars":7397,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Legal Services"],"lifecycle":[{"event":"open","at":"2026-10-26T19:32:42Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 4","filings_12m":4,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":192500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.602,"p_room":1,"age_days":0,"expected_fill_days":42,"reasons":["conf:1","stale_co","win:early","comp:junior,brand"],"computed_at":"2026-10-27T05:46:45Z"},"pay":null,"html_url":"https://alion.io/job/barnes-thornburg-information-security-grc-analyst","json_url":"https://alion.io/job/barnes-thornburg-information-security-grc-analyst.json","meta":{"generated_at":"2026-10-27T18:21:43Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8339,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4682},"rest":"https://alion.io/mcp/rest/get_company?id=4682"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbarnes-thornburg-information-security-grc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbarnes-thornburg-information-security-grc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbarnes-thornburg-information-security-grc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/barnes-thornburg-information-security-grc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbarnes-thornburg-information-security-grc-analyst"}]}