Information Security GRC Analyst III

We need to output HTML fragment with sections: headings using

for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include only sections that have real specific content. We must not repeat job title as heading. Must not include Job ID/requisition numbers as headings; fold minor metadata into short

or drop it. Must preserve all substantive info; remove boilerplate like EEO, legal, navigation, cookie, etc. Also remove duplicated lines, application instructions. Must not create Pay/Schedule/Benefits sections unless posting actually states them. The posting includes benefits list: "We Offer Competitive WagesHealth/Life BenefitsHealth Savings Account plus Employer Seed401(k) Savings Plan with Company MatchPaid Parental LeaveCompany Paid HolidaysPaid Time Off including Volunteer TimeTuition ReimbursementBusiness Casual EnvironmentRewards & Recognition ProgramEmployee Assistance ProgramOffice in downtown Greenville that offers free parking, onsite gym, free snacks/drinks". So we have benefits content. Pay: not explicitly stated (no salary figure). So we should not create Pay section. Schedule: not stated. So no Schedule section. We need sections: About the role (maybe from Position Summary). Responsibilities (list of duties). Requirements (Education Required, Experience Required). Qualifications (Preferred Qualifications maybe). Skills (Knowledge Required maybe). Benefits (the list). Also maybe "Physical Requirements" could be part of Requirements? But we can include as part of Requirements or separate? The instruction says use headings for those specific categories; we can include only those that have content. Physical Requirements could go under Requirements or maybe a separate section not listed; but we should stick to allowed headings. Could incorporate physical requirements into Requirements as a list. We must not repeat job title. Must not include requisition ID as heading; we can put it in a short

maybe but it's minor metadata; we could drop it. Probably drop it. We must remove boilerplate: EEO statement, "All qualified applicants will receive consideration..." etc. Also remove "To learn more about Purpose Financial visit Purpose Financial Website." Also remove "Brand: Purpose Financial Address: ..."? That's maybe metadata but could be included as short

about company? The instruction: "Do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

or drop it." So we could include address and brand in a short

at top. But we need to preserve all substantive information; address is maybe not substantive for the job? It's location info; could be considered metadata. Might be okay to drop? But better to include as a short

maybe under an "About the company" but we don't have that heading. Could include as a

before sections. We need to output only HTML fragment, no /, no markdown. Let's structure:

Brand: Purpose Financial. Address: 322 Rhett Street, Greenville, South Carolina, United States - 29601.

Then

About the role

with the Position Summary paragraph(s). The Position Summary: "Design, implement, audit, and maintain governance, risk management, and compliance (GRC) controls for Purpose Financials information security program. This role is the operational backbone of our compliance posture owing to SOC 2 Type II readiness and certification, driving ISO 27001 certification and ongoing ISMS maintenance, and supporting the broader Information Security Program across NIST CSF, NIST SP 800-53/800-171, CIS Controls, and PCI DSS. The ideal candidate brings an organized, project-managed approach to policy, risk, third-party oversight, audit readiness, and continuous compliance. Partnering closely with IT, SecOps, Legal, Internal Audit, and business stakeholders to protect the information assets owned by or entrusted to the Company." We'll put that in

. Then

Responsibilities

with

• for each bullet. The responsibilities list is long; we need to capture each bullet as separate
• . The text includes many items separated by periods and line breaks. We'll parse them: - Governance & Policy - Maintain and evolve the Company's information security policies, standards, and controls mapped to SOC 2, ISO 27001, NIST, and CIS frameworks; manage the policy exception process with documented justification and approval. - Risk Management - Conduct risk assessments, maintain the risk register, and support risk acceptance decisions with structured evidence; escalate material risks to leadership with mitigation plans. - Compliance & Audit Readiness - Own end-to-end audit preparation for SOC 2 Type II and ISO 27001 certification, including control testing, evidence collection, gap remediation, and findings tracking. Maintain the Company's ISMS, conduct Statement of Applicability (SoA) reviews, support internal audits and management reviews, and serve as the primary liaison with external certification bodies throughout the certification and surveillance audit lifecycle. - Control Implementation & Monitoring - Partner with IT and SecOps to operationalize controls across access management, encryption, logging, vulnerability management, and backup/DR; define evidence sources and test cadence. - Continuous Monitoring - Leverage GRC platform automated monitoring capabilities to maintain real-time visibility into control health; triage failing controls, coordinating remediation with owners, and ensure evidence remains audit-ready throughout the observation period. - Evidence Collection & Management - Maintain a structured evidence repository (e.g., SharePoint, GRC platform) to support SOC 2 Type II and ISO 27001 audit cycles; coordinate evidence requests from external auditors, establish and enforce evidence collection cadences (monthly, quarterly, and annual), and ensure completeness and integrity of the evidence package throughout the audit observation period. - Third-Party Risk Management (TPRM) - Manage the third-party risk management program including vendor risk assessments, security questionnaires (SIG/CAIQ), contract review support, and ongoing monitoring of critical vendors to ensure alignment with the Company's security and compliance requirements. - Change Management & Control Lifecycle - Manage the full control lifecycle including new control design, change management, deprecation, and exception handling; ensure all control changes are documented, reviewed, and aligned with SOC 2 Type II and ISO 27001 audit requirements. - Stakeholder Communications & Training - Develop and deliver control owner training, security awareness materials, and compliance guidance to drive adoption of security controls across business units; serve as a trusted advisor to cross-functional teams on GRC-related obligations and best practices. - Metrics & Reporting - Produce dashboards and status reports on risk posture, control health, and audit readiness for both technical teams and executive/Board-level stakeholders. - Operational Support - Support incident response, BCP/DR planning, and privacy obligations; publish practical guidance and job aids to drive control adoption across the organization. We'll output each as
• . Then

  Requirements

  with Education Required, Experience Required, Physical Requirements maybe. We'll combine Education and Experience as
  items. Also Physical Requirements could be a list. Education Required: Bachelor’s degree in Information Security or equivalent experience. Experience Required: 3–5+ years of experience in information security GRC, compliance, or audit roles. Hands-on experience with SOC 2 Type II audits (as auditee, control owner, or auditor). Working knowledge of SOC 2, ISO 27001, NIST CSF, NIST SP 800-53, and CIS Controls. Experience maintaining risk registers, conducting risk assessments, and managing remediation tracking. Strong written communication skills - ability to produce clear policy documents, audit evidence packages, and executive-level reports. Demonstrated ability to manage multiple workstreams with a project-managed approach. Experience with GRC platforms. We could split each sentence into
  • but maybe keep as paragraphs? The instruction: Use
    • for any list of duties/requirements/benefits. So we should make each requirement a list item. Could break down each bullet. Let's list: - Bachelor’s degree in Information Security or equivalent experience. - 3–5+ years of experience in information security GRC, compliance, or audit roles. - Hands-on experience with SOC 2 Type II audits (as auditee, control owner, or auditor). - Working knowledge of SOC 2, ISO 27001, NIST CSF, NIST SP 800-53, and CIS Controls. - Experience maintaining risk registers, conducting risk assessments, and managing remediation tracking. - Strong written communication skills - ability to produce clear policy documents, audit evidence packages, and executive-level reports. - Demonstrated ability to manage multiple workstreams with a project-managed approach. - Experience with GRC platforms. Physical Requirements: Could be separate but maybe under Requirements as a list. Physical Requirements: Sitting for long periods of time; standing occasionally; walking; bending; squatting; kneeling; pushing/pulling; reaching; twisting; frequent lifting of less than 10 lbs., occasional lifting of up to 20 lbs.; driving and having access during the workday to an insured and reliable transportation; typing; data entry; grasping; transferring items between hands and/or to another person or receptacle; use of office equipment to include computers; ability to travel to, be physically present at, and complete the physical requirements of the position at any assigned location. We could break into items but it's long; maybe keep as a single

      under Requirements? But instruction says use

      • for any list of duties/requirements/benefits. Physical Requirements is a list; we could make each item separated by semicolons as
      • . That would be many items; okay. Let's split by semicolons: - Sitting for long periods of time - Standing occasionally - Walking - Bending - Squatting - Kneeling - Pushing/pulling - Reaching - Twisting - Frequent lifting of less than 10 lbs. - Occasional lifting of up to 20 lbs. - Driving and having access during the workday to an insured and reliable transportation - Typing - Data entry - Grasping - Transferring items between hands and/or to another person or receptacle - Use of office equipment to include computers - Ability to travel to, be physically present at, and complete the physical requirements of the position at any assigned location That seems okay. Then

        Qualifications

        for Preferred Qualifications. List: - Experience in financial services, fintech, or consumer lending environments. - Familiarity with PCI DSS requirements and control environments. - Certifications: CISA, CRISC, CISSP, ISO 27001 Lead Auditor/Implementer, or equivalent. - Exposure to privacy frameworks (GLBA, CCPA, state-level financial privacy regulations) - Ability to work collaboratively with cross-functional teams and influence stakeholders. We could also include Knowledge Required as Skills section.

        Skills

        for Knowledge Required: Excellent written and verbal communications skills; adaptability and flexibility to changing environment; and comfortable working in a dynamic, high volume, fast-paced environment. Ability to understand and ensure compliance with policies, procedures, and laws governing our industry/business and products. We could split: - Excellent written and verbal communications skills - Adaptability and flexibility to changing environment - Comfortable working in a dynamic, high volume, fast-paced environment - Ability to understand and ensure compliance with policies, procedures, and laws governing our industry/business and products Then

        Benefits

        with list from "We Offer ..." The list is a bit jammed; we need to separate items: - Competitive Wages - Health/Life Benefits - Health Savings Account plus Employer Seed - 401(k) Savings Plan with Company Match - Paid Parental Leave - Company Paid Holidays - Paid Time Off including Volunteer Time - Tuition Reimbursement - Business Casual Environment - Rewards & Recognition Program