GRC Cybersecurity Controls Analyst

About the Team

TikTok is seeking a GRC Cybersecurity Controls Analyst to join the TikTok USDS Joint Venture (JV) GRC Controls & Certifications team. This role will support the operation, testing, and continuous improvement of the controls framework and will help drive audit readiness across key security, compliance, privacy, and regulatory obligations. The candidate will work closely with control owners, product teams, security teams, privacy, legal, internal audit, external auditors, and GRC leadership to evaluate control design, implementation, and operating effectiveness.

About the Role

The role will support control testing, evidence review, audit response coordination, control narrative development, and issue identification across frameworks and obligations such as ISO 27001, SOC 2, NIST CSF, PCI, control validation, and other certification or assessment activities. The candidate will also help mature the team’s approach to GRC automation and engineering. This includes improving how controls are mapped, tested, monitored, and reported through tooling, dashboards, structured data, workflow automation, evidence recommendations, and scalable testing. The ideal candidate is comfortable working at the intersection of GRC, security controls, audit readiness, and process automation.

Responsibilities

• Support the maintenance and continuous improvement of the controls framework, including control descriptions, mappings, owners, evidence expectations, testing procedures, and control narratives.
• Perform control testing and validation activities, including design, implementation, and operating effectiveness testing.
• Review evidence submitted by control owners and product teams to determine whether it sufficiently demonstrates control performance and meets audit or assessment expectations.
• Coordinate with control owners, evidence owners, product teams, and GRC stakeholders to resolve evidence gaps, clarify control intent, and improve testing quality.
• Support internal and external audits, certifications, and assessments, including ISO 27001, SOC 2, PCI, NIST CSF, and other GRC obligations.
• Support GRC automation initiatives by helping define requirements for workflow automation, control monitoring, and scalable control testing processes.
• Work with technical and engineering teams to understand security tools, data sources, system-generated evidence, and opportunities to automate or improve control validation.
• Contribute to a culture of high-quality documentation, defensible controls testing, and continuous improvement across the Controls & Certifications function.

Qualifications

Minimum Qualifications

• Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Risk Management, Compliance, Engineering, Data Analytics, or a related discipline, or equivalent practical experience.
• 3+ years of experience in GRC, IT risk, security controls, audit readiness, control testing, compliance, security assurance, or a related field. Experience performing or supporting control testing, including evaluating control design, implementation, and operating effectiveness.
• Experience gathering, reviewing, and assessing technical control evidence from stakeholders, systems, tools, dashboards, or documentation repositories.
• Working knowledge of security and compliance frameworks such as ISO 27001, NIST CSF, SOC 2, PCI-DSS, or similar control frameworks.
• Familiarity with security domains such as Identity and Access Management, Vulnerability Management, Incident Management, Asset Management, Logging and Monitoring, Data Security, SDLC, Third-Party Risk Management, Business Continuity / Disaster Recovery, or Privacy.
• Strong writing and documentation skills, with the ability to create clear control narratives, evidence and testing summaries, and status updates. Strong analytical skills and ability to assess whether evidence meets the intent of a control, requirement, or audit request.
• Experience working with control owners, technical teams, auditors, legal, privacy, compliance, or cross-functional stakeholders. Ability to manage multiple workstreams, follow up on open items, identify blockers, and communicate risks clearly. Demonstrated teamwork and collaboration skills, especially in fast-moving, cross-functional environments.

Preferred Qualifications

• Professional certification such as CISA, CISSP, CISM, CRISC, CDPSE, ISO 27001 Lead Auditor / Lead Implementer, or equivalent.
• Experience supporting external audits, security certifications, or regulatory assessments such as SOC 2, ISO 27001, PCI, NIST CSF, or national security / data protection obligations.
• Experience with GRC automation, control monitoring, evidence automation, dashboarding, workflow design, or data-driven control testing. Experience working with engineering, security, infrastructure, product, or data teams to translate technical processes into control evidence and audit-ready narratives.
• Familiarity with automation, scripting, SQL, APIs, or data workflows used to improve GRC operations.
• Experience maintaining or improving a control library, control framework, control mapping, or integrated compliance framework. Experience identifying evidence quality issues, control design gaps, operating effectiveness concerns, or audit readiness risks.

Benefits

Employees have day one access to medical, dental, and vision insurance, a 401(k) savings plan with company match, paid parental leave, short-term and long-term disability coverage, life insurance, wellbeing benefits, among others. Employees also receive 10 paid holidays per year, 10 paid sick days per year and 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure). The Company reserves the right to modify or change these benefits programs at any time, with or without notice.

Pay

The base salary range for this position in the selected city is $98,800 - $196,000 annually. Compensation may vary outside of this range depending on a number of factors, including a candidate’s qualifications, skills, competencies and experience, and location. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units.

Schedule

On-site presence across teams allows the company to operate with greater speed, alignment, and agility — especially in areas like real-time decision-making, team development, and integrated execution. As such, the company is shifting from a hybrid work model to a fully in-person schedule up to 5 days a week.