GRC Analyst – Corporate IT Security

About the role

The GRC Analyst will support the Governance, Risk, and Compliance program for FirstBank's corporate IT security function. This role assists the GRC Manager in assessing, prioritizing, and remediating cybersecurity and compliance risks across the organization.

Key responsibilities

• Maintain and enhance information security policies, procedures, standards, and governance practices aligned with regulatory requirements and industry best practices.
• Conduct risk assessments, recommend mitigation strategies, and track remediation efforts to ensure timely resolution.
• Coordinate internal and external audits, provide documentation and evidence, and follow up on findings and corrective action plans.
• Monitor remediation of technology, cybersecurity, and audit findings, ensuring accountability and successful closure.
• Support vendor governance documentation and third‑party risk management activities.

Required profile

• Bachelor’s degree in Information Systems, Computer Science, or a related field.
• Three to five years of experience in governance, risk, and compliance or a similar role.
• Strong communication skills in English and Spanish.
• Ability to work under pressure, manage multiple priorities, and collaborate with cross‑functional teams.

Required skills

• Knowledge of ISO 27001, NIST, GLBA, SOX, and COBIT frameworks.
• Advanced proficiency with Microsoft Office for data analysis and reporting.
• Experience with risk assessment methodologies and security metrics.
• Familiarity with vendor risk management and audit coordination.