Cybersecurity GRC Analyst II

Introduction

The role of a Cybersecurity GRC Analyst is essential to maintaining and elevating the security posture of an organization operating across a decentralized portfolio of 29 independently operated businesses. GRC Analysts are responsible for assessing risk, validating cyber controls, and driving compliance with the frameworks and regulatory environments that govern the organization. This document outlines the job expectations for a Cybersecurity GRC Analyst at the Level II, covering their role, responsibilities, and essential skills. At the Level II, the analyst is expected to operate with greater independence and ownership than at the entry level, taking assigned governance, risk, and compliance workstreams from start through to completion.

Core Values - Be Humble, Be a Solver, Keep it Simple, Own it, Core Responsibilities

Cyber Health Checks and Control Review

A Cybersecurity GRC Analyst is expected to assess the design and implementation of cyber controls across Roper's businesses during cyber health check visits. At the Level II, the analyst leads assigned portions of these reviews and exercises independent judgment on control efficacy. This role includes on-site visits to portfolio businesses, and travel can reach up to 30 percent depending on the assessment schedule, though it is not guaranteed and will vary throughout the year.

• Conducting cyber health checks with the cyber team, both remote and on-site, across a variety of businesses and their independent environments.
• Validating control design and implementation through discussion and evidence review.
• Assessing control gaps and documenting findings and recommended remediation clearly for both technical and business audiences.
• Validating the efficacy of cyber remediation measures and confirming that findings are appropriately closed.

Risk and Compliance Assessment

Maintaining the organization's risk and compliance stance against various frameworks and regulatory environments is a central responsibility. The analyst helps ensure businesses of differing size and maturity are measured consistently against Roper standards.

• Performing cyber and privacy assessments against emerging regulations and evolving compliance requirements.
• Conducting risk assessments and gap analyses across companies with differing security maturity.
• Tracking cyber findings and recommendations to ensure that appropriate mitigation actions are taken while supporting necessary compliance activities.
• Preparing and delivering risk and compliance reporting to security and business stakeholders.

Policy Management and Governance

Sound policy is the foundation of a strong governance program. The analyst owns the upkeep of cybersecurity policy and supports the consistent application of governance standards across the portfolio.

• Owning cybersecurity policy management and maintenance, keeping policies current and aligned to the threat landscape.
• Supporting the consistent application of Roper cyber controls and governance standards across all businesses.
• Collaborating with other cyber teams to ensure security best practices are implemented.

Acquisition (Bolt-On) Support

Roper is an active acquirer, and newly acquired businesses must be brought onto Roper cyber controls. The analyst supports this onboarding using the standard Roper methodology.

• Supporting the onboarding of newly acquired businesses to Roper cyber controls on the established timeline.
• Assisting with security and compliance diligence for acquisition targets as needed.

Career Path and Advancement

A Cybersecurity GRC Analyst can pursue various career paths within the cybersecurity field. Common trajectories include:

• Senior Cybersecurity GRC Analyst: Senior analysts lead the GRC program, own portfolio relationships, mentor junior analysts, and contribute to the development of security policies and procedures.
• Cybersecurity Governance Manager: Progression to managerial roles overseeing broader governance, risk, and compliance strategies and initiatives within an organization.
• Security Operations Manager: Managers are responsible for the overall operations of the security program, including managing personnel, resources, and processes.
• Chief Information Security Officer (CISO): For those with significant experience and expertise, the role of CISO involves leading the organization's entire cybersecurity framework and strategy.

Continuous Learning

The cybersecurity landscape is constantly evolving, and Cybersecurity GRC Analysts must stay current with the latest frameworks, regulations, and practices. Roper assesses its businesses against a custom internal controls framework, so the ability to learn and apply that framework is central to the role. A working knowledge of established frameworks such as NIST, CSF, and ISO 27001 provides a strong foundation for that work.

• Commitment to ongoing education and professional development.
• Familiarity with established security and risk frameworks such as NIST, CSF, and ISO 27001, which inform Roper's custom controls framework.
• Experience with a governance, risk, and compliance platform is a plus (Optro, Vanta, Etc)
• Obtaining and maintaining relevant certifications, such as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), or Certified in Risk and Information Systems Control (CRISC).
• Participating in industry conferences, workshops, and training sessions.

Conclusion

Cybersecurity GRC Analysts play a pivotal role in safeguarding an organization's digital assets by assessing risk, validating controls, and driving compliance across the portfolio. Their responsibilities encompass cyber health checks, risk and compliance assessment, policy management, and acquisition support. Essential skills for this role include analytical ability, strong communication, attention to detail, and a commitment to continuous learning. As the regulatory and threat landscape continues to evolve, the role of the Cybersecurity GRC Analyst will remain indispensable in protecting the organization.