Associate Analyst, IT Governance Risk & Compliance

About the role

Provides entry-level support for the Cyber Security Governance, Risk, and Compliance (GRC) program, under regular guidance and direction from the GRC Lead. Supports risk assessments, third-party reviews, audit and compliance support, policy administration, evidence collection, issue tracking, and reporting.

Responsibilities

• Assist with routine IT and Cyber Security risk assessments by gathering evidence, documenting results in established templates, and escalating questions, exceptions or potential concerns for review
• Supports third-party risk activities by tracking requests and questionnaires, organizing vendor evidence, completing initial completeness checks, and maintaining assessment records
• Supports framework assessments, audits and compliance reviews by coordinating evidence requests, organizing artifacts, reviewing submissions for completeness against established requirements, and documenting follow-up items
• Maintains accurate GRC records, including risk registries, controls, issues, action plans, exceptions, and assessment status, in approved systems and repositories
• Aids in mapping policies, controls, and evidence to requirements and frameworks, such as NIST CSF 2.0, ISO 27001, and CIS Controls, using documented procedures
• Tracks assigned remediation activities and due dates, follows up with action owners, documents updates, and escalates overdue or unclear items
• Aids in policy and procedure administration through formatting, review routing, version control, publication, and maintenance of communication or training records
• Prepares routine metrics, dashboards, and status reports using established templates; validates data accuracy and supports investigation of identified data variances under guidance
• Participates in meetings, training, assigned research and process improvements activities; communicates professionally, protects confidential information, and performs assigned GRC support duties

Requirements

• Bachelor's degree in Cybersecurity, IT, Information Systems, Business, Risk Management, or a related field and 0-2 years of related experience; internships, co-ops, academic projects, labs, or equivalent practical experience qualify OR
• Associate's degree in Cybersecurity, IT, Information Systems, Business, Risk Management, or a related field and 1+ year of related experience, including internships, co-ops, military service, or equivalent practical experience
• Certification is not required; relevant coursework, training, or a foundational certification is preferred

Qualifications

• Understands Neurocrine's objectives and begins to develop knowledge of its business, services, customers, and operating environment
• Works collaboratively, follows direction, asks questions, and applies feedback
• Proficient with Microsoft 365 applications
• Good communication, problem-solving, and analytical skills
• Detail oriented, with a focus on data quality, accuracy, and follow-through
• Organizes work, follows established priorities, and meets deadlines with guidance
• Foundsational understanding of IT cybersecurity, governance, risk, compliance and IT controls gained through education, training, internships, projects or related experience
• Interested in pursuing relevant foundational cybersecurity or GRC certifications as part of ongoing professional development
• Familiarity with NIST CSF, ISO 27001, CIS Controls, or SOC 2 through coursework or experience
• Ability to collect, organize, and review evidence against defined criteria under supervision
• Ability to document processes, notes, and findings clearly using established templates
• Ability to handle confidential information with discretion and follow established procedures
• Ability and willingness to learn GRC processes, tools, and authoritative guidance; receive coaching and apply feedback; and pursue ongoing professional development
• Familiarity with automation tools and Artificial Intelligence (A.I.) concepts, including responsible use, privacy, and security

Skills

• Foundational understanding of IT cybersecurity, governance, risk, compliance and IT controls gained through education, training, internships, projects or related experience
• Familiarity with NIST CSF, ISO 27001, CIS Controls, or SOC 2 through coursework or experience
• Basic spreadsheet skills to sort, filter, reconcile, and summarize information accurately
• Ability to document processes, notes, and findings clearly using established templates
• Ability to handle confidential information with discretion and follow established procedures
• Ability and willingness to learn GRC processes, tools, and authoritative guidance; receive coaching and apply feedback; and pursue ongoing professional development
• Familiarity with automation tools and Artificial Intelligence (A.I.) concepts, including responsible use, privacy, and security

Benefits

• Annual bonus with a target of 15% of the earned base salary
• Eligibility to participate in our equity based long term incentive program
• Retirement savings plan (with company match)
• Paid vacation, holiday and personal days
• Paid caregiver/parental and medical leave
• Health benefits to include medical, prescription drug, dental and vision coverage in accordance with the terms and conditions of the applicable plans