GRC & Third-Party Risk Analyst

About the role

We are looking for a GRC & Third‑Party Risk Analyst to execute and run our governance, risk, and compliance (GRC) and third‑party risk management (TPRM) activities within a global, decentralized organization. This individual‑contributor position requires solid hands‑on experience, the ability to work autonomously on day‑to‑day GRC and vendor‑risk tasks, and collaboration with a broader GRC team.

Key responsibilities

• Execute day‑to‑day GRC activities such as risk assessments, control testing, policy reviews, gap analyses and compliance monitoring.
• Conduct end‑to‑end third‑party risk assessments, including due‑diligence reviews, security questionnaires, risk scoring and ongoing monitoring.
• Assess and document compliance with regulations such as DORA, NIS2, the EU AI Act and GDPR, and flag remediation actions.
• Maintain alignment with frameworks like ISO 27001/27005, NIST CSF/800‑53 and PCI DSS, preparing evidence for audits and certifications.
• Support incident response and business continuity from a risk and compliance perspective, especially when third parties are involved.

Required profile

• Minimum 2 years of experience in Governance, Risk & Compliance and at least 1 year in third‑party/vendor risk management.
• Experience working in global, distributed organizations and maintaining a risk register with scoring, tracking and periodic review.
• Master’s degree in cybersecurity or a closely related field.
• Bilingual French and English (written and spoken).

Required skills

• ISO 27001 / ISO 27005
• NIST CSF and NIST 800‑53
• PCI DSS
• DORA, NIS2, EU AI Act, GDPR
• Understanding of AI/ML risk and governance