Job functions

26 things a GRC analyst actually does.

Each entry has why it matters, when it is done, inputs and outputs, a beginner example, and the common mistakes. Useful for resume framing, interview prep, and the post-hire first-90-days plan.

Maintain the organizational risk register

Calibrate risk-scoring scales with the business

Run the internal audit cycle

Collect and organize audit evidence

Track findings through remediation and verification

Write a control test (inquiry/observation/re-performance)

Maintain the third-party inventory

Review vendor security reports (SOC 2, ISO certs)

Triage a vendor-incident notification

Draft an information security policy

Maintain the policy hierarchy

Deliver annual security training

Operate a phishing simulation program

Coordinate incident response end-to-end

Run an incident-response tabletop exercise

Classify data across systems

Map personal-data flows

Conduct a Data Protection Impact Assessment

Respond to data subject rights requests

Operate the audit evidence room

Drive SOC 2 / ISO readiness

Build and maintain a control matrix

Prepare board-level risk reporting

Lead cross-functional risk projects

Evaluate GRC / compliance tooling

Coach junior analysts and cross-functional partners