GRC analyst job description: template and tips

Many GRC analyst job ads stack up frameworks (ISO 27001, NIS2, DORA, GDPR) without saying what the person will actually do all day. Good candidates want to know whether they will move a programme forward or fill in spreadsheets nobody reads. This guide gives you a structure, an annotated template and the wording to avoid, so your GRC analyst job description attracts rigorous, useful people.

What a GRC analyst looks for in a job ad

A GRC candidate reads an ad with one question in mind: will I have the means to get what I write applied? They look for clear answers on a few points.

Regulatory scope: which frameworks really apply, which are planned, and which are in the ad out of habit.
Programme maturity: a certification already in place to maintain, a project under way, or a blank page.
Mandate: who they report to, and whether leadership backs them when a team does not keep its commitments.
Operational share: a pure GRC role, or one where they will also manage access, firewalls or support.
Growth: a path to GRC lead, CISO, or audit.

If you have not settled these points internally, start with our guide to hiring a GRC analyst, which helps you choose between analyst, consultant, auditor and lead before you write anything.

Set the scope before you write

The job description should reflect a need, not a wish list. Three scopes come up often, and each calls for a different ad.

Scope	Main duties	What the ad should emphasise
Maintaining a certification	Risk reviews, tracking nonconformities, preparing surveillance audits	Rigour, evidence management, working with auditors
Regulatory compliance	Gap analysis, action plan, follow-up with technical and business teams	Reading regulations, prioritising, driving change
Customer and supplier assurance	Security questionnaires, supplier assessments, contract clauses	Clear writing, working with procurement and sales

A role can combine two scopes, rarely all three without help. If the need comes from a certification project, our article on the profiles needed for ISO 27001 certification shows how to split the roles.

The annotated template

Here is a framework to adapt. Each block is followed by a note on what it should contain.

1. Title

Example: "GRC Analyst, NIS2 and ISO 27001 compliance, Nantes, hybrid".
Note: the role, one or two main frameworks and the location are enough. Titles like "Security Officer" or "Security project officer" are searched less and mean different things to different people.

2. Context

Your business in two sentences, the size of the security team, the reporting line (CISO, risk, legal, IT).
Why the role is open: a new regulatory obligation, a customer requirement, a certification project, growth, a replacement.
Note: the reporting line tells candidates a lot. An analyst reporting to the CISO has a different day from one reporting to group compliance. Say it plainly.

3. Duties

For a compliance-focused role, for example:

Run risk analysis with business and technical teams and follow treatment plans.
Keep the statement of applicability and the nonconformity register up to date.
Prepare evidence and support internal and external audits.
Assess critical suppliers and follow their security commitments.
Answer customer security questionnaires with the teams involved.
Produce a monthly report the CISO and leadership can read.

Note: list four to six real duties, ordered by how much time they take. If customer questionnaires fill half the week, write it down: a candidate who discovers it after joining will not stay.

4. Framework and tools

The applicable frameworks and their status (achieved, in progress, upcoming).
The risk method in use, for example EBIOS Risk Manager, published by ANSSI, the French national cybersecurity agency.
The tools: GRC platform, spreadsheets, ticketing, document management.
Note: present tools as context, not as requirements. A rigorous analyst learns a GRC platform quickly. What cannot be learned in a few weeks is a sense of priorities.

5. Profile

Keep two short, separate lists.

Must have:

Explain a framework requirement in their own words and say how to evidence it.
Link a risk to an asset, a threat, a business impact and a control.
Understand enough technology to spot a vague answer about access reviews, patch management or backups.
Write short, precise documents that the people applying them can use.
Move forward an action that depends on another team, without line authority.

Nice to have:

Involvement in a certification audit, as auditee or auditor.
Experience in a regulated sector (healthcare, finance, energy, public sector).
A certification such as ISO 27001 Lead Implementer or Lead Auditor.
Hands-on use of a GRC platform or automated reporting.

Note: phrase skills as observable actions. "Can prioritise five audit findings and justify the order" says far more than "expert knowledge of ISO 27001".

6. Terms

Salary range.
Remote work policy and travel, especially across several sites or subsidiaries.
Training budget and funded certifications.
Note: GRC salaries vary with the sector, the level of regulation and the breadth of scope. A realistic range saves weeks of conversations with candidates outside your budget. Our article on cybersecurity time to hire shows how much that vagueness costs.

7. Hiring process

The number of steps, their length and what the case study involves.
Note: see the dedicated section below.

Be honest about the mandate

This is the point GRC job ads dodge most often, and the one that worries experienced candidates most. A GRC analyst without leadership backing spends their days chasing teams that never reply.

At minimum, state:

who the analyst presents metrics to, and how often;
who decides when a team refuses or postpones a control;
whether a security committee already exists, and who sits on it;
whether leadership is involved, as the NIS2 directive (Directive (EU) 2022/2555) requires for in-scope entities.

This paragraph filters out candidates looking for a paperwork-only job and reassures those who want real impact. If nobody sets direction, the ad should target a lead or a CISO instead.

Wording that drives candidates away

A list of frameworks as the profile: ISO 27001, 27005, NIS2, DORA, GDPR, SOC 2, all "mastered". Nobody ticks every box, and strong candidates move on.
Mixing GRC with operations: a role that combines compliance, firewall administration and user support will always sacrifice compliance to the urgent.
Certifications required on principle: they show knowledge of a framework, not the ability to make it work. Our take on certifications in hiring helps you list them as "nice to have".
A purely legal or purely technical profile: the role needs both views. Write what you expect from each.
Empty jargon: "compliance culture", "unwavering rigour", "demanding environment". Describe a concrete deliverable instead.
No salary range: an ad without pay information gets fewer replies from candidates who already have a job.

Describe the assessment

A standard interview does not show whether a candidate can prioritise or write clearly. An ad that announces a short case study shows the team knows what it is looking for. A typical process:

A first conversation about background, frameworks used and expectations.
A case study on a fictional file: prioritise audit findings, critique a supplier's answers, propose a metric.
A debrief of the case study with the CISO or GRC lead.
A conversation with a key future stakeholder, such as IT or procurement.

State how long the case study takes and that it uses fictional data. Our method for assessing cybersecurity skills explains how to score such an exercise with a shared grid.

Checklist before publishing

The scope is clear: maintenance, compliance, customer and supplier assurance, or a deliberate combination.
The frameworks cited are the ones that really apply, with their status.
Duties are real, ordered by weight, four to six of them.
Must-have requirements fit in five lines, written as actions.
Reporting line and mandate are described.
A salary range is shown.
The hiring process and case study are announced.

In short

A good GRC analyst job description sets a clear scope, cites only the frameworks that really apply, describes real duties, owns the mandate given to the role and announces a case study. That is what lets a rigorous candidate recognise themselves, and lets you spot them.

Opening a GRC analyst role and want help scoping it? At Cyber Recrut, a recruiter and a security practitioner build the job description with you, then our shortlisted candidates prove their skills on hands-on labs and scenarios close to your context. See how we work or tell us about your hiring need.