Cybersecurity Governance, Risk & Compliance (GRC) Analyst

Itron is innovating new ways for utilities and cities to manage energy and water. We create a more resourceful world to protect essential resources for today and tomorrow. Join us.

The Cybersecurity Governance, Risk & Compliance (GRC) Analyst supports the organization’s global cybersecurity governance and regulatory compliance programs. This role assists with the development, maintenance, and continuous improvement of security governance processes, internal controls, audit readiness activities, and compliance initiatives aligned to regulatory, contractual, and industry requirements.

The position focuses on governance activities related to Sarbanes-Oxley (SOX), ISO 27001/27002 and 27017, and SSAE-18 (SOC 1 and SOC 2). The role also supports regulatory compliance obligations associated with the European Union Network and Information Security Directive (NIS2), Australia’s Security of Critical Infrastructure (SOCI) Act, and Cyber Essentials governance expectations in the United Kingdom and other countries.

This role works across Information Security, Internal Audit, Legal, Compliance, IT Operations, and business teams to assess control effectiveness, identify gaps, coordinate audit evidence, track remediation, and provide clear compliance reporting to management.

Duties & Responsibilities

• Assist in managing cybersecurity compliance activities across multiple frameworks and countries to include EU NIS2, Australia SOCI, UK Cyber Essentials.
• Assist in interpreting regulatory and statutory requirements partnering with internal teams and business stakeholders, then translate obligations into actionable security controls and processes.
• Conduct compliance gap assessments and maintain remediation plans through closure.
• Help maintain regulatory obligation registers, compliance trackers, evidence repositories, and status reporting artifacts.
• Monitor emerging cybersecurity regulations and legislative developments that may affect global security governance obligations.
• Support internal and external audits related to SOX, SSAE-18, ISO, NIS2, SOCI, and Cyber Essentials requirements.
• Assist in tracking audit findings, observations, control deficiencies, and management action plans through remediation and closure.
• Partner with Information Security and other internal teams and business leaders to meet governance and compliance objectives.
• Assist in providing guidance to stakeholders regarding governance requirements, audit expectations, evidence needs, and regulatory obligations.

Required Skills & Experience

• Bachelor’s degree in Cybersecurity, Business Administration or a related field, or equivalent work experience.
• At least 1 year of experience in information security governance, compliance, audit, risk management, IT controls, or related disciplines.