GRC Analyst

About UsAt Cast & Crew, we’ve empowered creativity and supported the global entertainment industry for decades. Together with our family of brands - Backstage, CAPS, Checks & Balances, Final Draft, Media Services, Sargent-Disc, and The TEAM Companies – we operate as a combined entertainment technology and services provider offering industry standard screenwriting accounting software, digital payroll products, data & reporting, and a host of creative tools. The industry continues to move faster than ever, and the need for our expertise, our technology, and our people has never been greater. We are a production’s best ally every step of the way. #OneCastOneCrewPosition Overview:The GRC Analyst supports the Information Security Office by managing third-party vendor risk, processing security questionnaires, and assisting with audit and compliance activities across the enterprise. This role is well-suited for someone with a strong compliance background who is looking to grow within information security. The ideal candidate is detail-oriented, organized, and experienced working with compliance frameworks, audit processes, and GRC tools such as Drata or similar platforms. A willingness to learn security concepts and stay current on evolving practices is essential.Essential Functions Managing the end-to-end third-party vendor risk management program, including onboarding assessments, periodic reviews, and ongoing monitoring of vendor security posture. Supporting an internal ISRM program focused on uncovering cybersecurity risk and adding it to a risk register for prioritization and acceptance and ownership or remediation Completing and responding to inbound security questionnaires (e.g., SIG, CAIQ, custom questionnaires) from clients and partners in a timely and accurate manner. Coordinating information gathering and interviewing of internal stakeholders to support third-party security questionnaire responses. Supporting and maintaining the organization's compliance automation platforms (e.g., Drata and Andromeda), including evidence collection, control mapping, and readiness tracking. Supporting SOC 1 Type 2 and SOC 2 Type 2 audits, including evidence collection, auditor coordination, and remediation of identified gaps. Developing, maintaining, and improving security documentation, policies, standards, procedures, and runbooks. Monitoring and reporting on internal control effectiveness and audit readiness posture. Advising internal lines of business, IT partners, and third parties on how to remediate security gaps identified through assessments or audits. Understanding applicable regulations, guidelines, and industry best practices to manage risk and ensure compliance. Drafting and presenting risk reports and proposals to executive leadership and senior staff. Performing other duties as directed. Qualifications:The following certifications are a plus, but are not expected at the time of hire: CISA or CISM (compliance/audit-focused; strongly relevant to this role) CRISC (risk and controls focus) CISSP, GIAC/GSEC, or vendor certifications (AWS/Azure) Requirements:5+ years of experience in compliance, audit, GRC, or a related field, with exposure to information security concepts. Equivalent experience in risk management, regulatory compliance, or internal audit will be considered. Candidates should have working knowledge of the following: Compliance frameworks, audit processes, or risk management programs SOC 1 or SOC 2 audit support or audit evidence collection (direct audit experience a plus) Development or maintenance of policies, procedures, and compliance documentation Third-party or vendor risk processes (experience with formal TPRM programs a plus) GRC or compliance automation tools (e.g., Drata, Andromeda, or similar platforms) Communications: Excellent oral communication skills and comfortable in group or small team settings Excellent written communication skills Ability to take highly technical material and present/communicate it to a non-technical audience Relationship Building:Builds excellent working relations with all IT colleagues and users, works effectively with department and executive management, and maintains a professional relationship with outside clients and vendorsPlanning, Organizing, Prioritizing, Delivering: Exhibits mature organization and time management skills Excellent problem-solving skills Effectively planning and organizing daily work following priorities set by the Risk Manager Demonstrates strong follow-up and follow-through skills in ensuring timely completion of projects Self-starter who actively takes responsibility to resolve issues but also knows when to ask questions to avoid major delays in delivery of work product Knowledge of: SOC 1 Type 2 and SOC 2 Type 2 audit processes and control frameworks GRC and compliance automation tools, with preference for Drata Security questionnaire frameworks (e.g., SIG, CAIQ, NIST) and third-party risk methodologies Evidence collection, re