Governance, Risk & Compliance (GRC) Senior Analyst

Bennett Thrasher is seeking an IT Governance, Risk & Compliance (GRC) Analyst to support our technology compliance, risk, and data-governance programs.

This hands-on role helps maintain year-round SOC 2 readiness, coordinates IT controls and access reviews, supports Microsoft Purview and data-retention initiatives, administers security awareness activities, and ensures compliance documentation remains organized and audit-ready.

The ideal candidate has experience in IT audit, GRC, cybersecurity compliance, or technology risk and is ready to continue developing their expertise.

What You’ll Do

• Maintain the SOC 2 control calendar and coordinate recurring control activities.

• Collect, review, and maintain audit evidence and documentation.

• Track control gaps, exceptions, remediation plans, and outstanding items.

• Coordinate SOC 2 readiness activities and external auditor requests.

• Perform and document recurring user and privileged-access reviews.

• Support Microsoft Purview, including data classification, DLP, sensitivity labeling, and retention.

• Assist with development and implementation of the firm’s data-retention program.

• Administer security awareness campaigns, phishing simulations, and reporting.

• Maintain IT compliance and security policies and coordinate periodic reviews.

• Review change requests for compliance, risk, data protection, and audit requirements, ensuring proper approvals and documentation.

• Assist with technology risk assessments, vendor security reviews, and client security questionnaires.

• Maintain risk and remediation registers and follow up with control owners.

• Prepare compliance reporting for IT leadership.

• Identify opportunities to automate compliance monitoring and evidence collection.

• Escalate significant control failures, risks, and policy exceptions.

• Review change requests for compliance, risk, data protection, and audit requirements, ensuring proper approvals and documentation.

What We’re Looking For

• 4+ years of experience in IT GRC, IT audit, cybersecurity compliance, technology risk, SOC/SOX controls, or information security.

• Understanding of IT controls, audit evidence, and risk-management concepts.

• Experience with Microsoft 365 or similar enterprise technology environments.

• Strong organization, documentation, communication, and follow-through skills.

• Ability to work independently and coordinate across multiple teams.

Preferred

• SOC 2 audit or readiness experience.

• Microsoft Purview, Entra ID, DLP, or data-retention experience.

• Experience with access reviews or GRC/compliance platforms.

• Vendor/third-party risk experience.

• Security awareness program administration.

• Experience in accounting, financial services, professional services, or another environment handling sensitive client information.

• Security+, CISA, CRISC, CGRC, Microsoft security/compliance, or similar certification—or interest in pursuing one.