Mid Level IT Grc Analyst/Itgc & Audit N/I NOVO

The Mid Level IT GRC Analyst/ITGC & Audit is a critical member of that program reporting directly to the Compliance Program Lead and is the person who makes sure ITGC and QMS controls are tested, evidence is solid, and auditors never catch the team off guard. You will work across a globally distributed environment, partnering with IT product teams, security, risk management, and internal/external auditors operating in multiple jurisdictions.

Main responsibilities:

• Test and validate ITGC controls across key domains: Access Management, Change Management, Cybersecurity Operations, Database & Network Controls, and Resilience;
• Support QMS control testing for both Global and Territory-specific controls — walkthroughs, sample testing, re-performance, and inspection;
• Facilitate internal and external audits (SOC 2, ISO 27001, 7216) — coordinate evidence requests, field auditor inquiries, and ensure smooth audit lifecycle execution;
• Collect, review, and validate audit evidence for completeness, accuracy, and alignment to control requirements;
• Field compliance-related inquiries from product teams and stakeholders; translate standards into actionable guidance;
• Document remediation plans for audit findings and ITGC/QMS deficiencies; track progress through closure;
• Prepare compliance status reports and maintain dashboards and monitoring tools for the CPL and senior management;
• Support and coordinate quarterly and ad-hoc access reviews aligned with access control standards;
• Proactively flag compliance risks and control weaknesses before they surface as audit findings.

What experience we expect from you:

• Experience in compliance, IT audit, ITGC testing, QMS testing, or risk management in a regulated IT environment;
• Demonstrated experience validating ITGC controls (access management, change management, SDLC, cybersecurity operations, and resilience);
• Strong understanding of SOC 2, ISO 27001, and 7216 frameworks — with hands-on audit facilitation experience;
• Working knowledge of information security policies (ISP) and control frameworks; ability to interpret standards and help teams apply them;
• Proficiency in Microsoft Office, evidence management platforms, GRC tools, and compliance dashboards;
• Excellent written and verbal communication in English — ability to engage technical teams and senior leadership;
• Ability to manage multiple concurrent audits, testing cycles, and reporting deadlines simultaneously.

Nice to have:

• CISA (Certified Information Systems Auditor) — strongly preferred;
• CRISC, ISO 27001 Lead Auditor, or QMS-related certifications;
• Experience with QMS testing across Global and Territory-specific control frameworks;
• Familiarity with vulnerability scanning tools and penetration testing evidence review;
• Experience supporting or executing remediation tracking programs.