Business Analyst, GRC
Location: Ottawa, Ontario | On-site
Company: GRC Concierge
Employment Type: Full-Time
About GRC Concierge
GRC Concierge is a growing cybersecurity and compliance managed services company delivering white-glove Governance, Risk, and Compliance (GRC) services to organizations across North America.
We combine technical expertise, proactive service, and exceptional client relationships to make compliance simpler, more effective, and less overwhelming for the businesses we support.
As we continue to scale, we're looking for a Business Analyst, GRC & Compliance to join our Service Delivery team and support the development of compliance policies, procedures, and documentation for our clients.
About the Role
The Business Analyst, GRC & Compliance will be responsible for translating business processes, regulatory requirements, and compliance frameworks into clear, practical, and well-structured documentation.
Working alongside our GRC Engineers and Service Delivery leadership, you will gather requirements, assess client operations, identify compliance gaps, and independently develop policies and procedures aligned with applicable frameworks.
This role requires existing knowledge of compliance frameworks and demonstrated experience developing compliance documentation. We are looking for someone who can contribute immediately, not someone who needs to learn the fundamentals of GRC.
Key Responsibilities
- Independently develop, review, and maintain client compliance policies, procedures, standards, and supporting documentation.
- Gather and document business requirements through client discussions, stakeholder interviews, and process reviews.
- Interpret SOC 2, ISO 27001, and other applicable framework requirements and translate them into practical policies and procedures.
- Conduct gap assessments to identify missing documentation, process weaknesses, and opportunities for improvement.
- Work closely with GRC Engineers to ensure policies align with applicable controls, frameworks, and audit requirements.
- Create and maintain process documentation, workflows, templates, and standard operating procedures.
- Support risk assessments, control documentation, and compliance readiness activities.
- Coordinate policy reviews, approvals, version control, and documentation updates.
- Participate in client meetings to gather information, clarify requirements, and communicate documentation needs.
- Support continuous improvement of internal templates, documentation standards, and delivery processes.
What We're Looking For
- Compliance Framework Expertise: Working knowledge of SOC 2 Trust Services Criteria and ISO 27001, including the ability to interpret control requirements and apply them to client environments.
- Policy Writing: Demonstrated ability to independently develop clear, accurate, audit-ready compliance policies, procedures, and supporting documentation.
- Business Analysis: Strong requirements gathering, process mapping, gap analysis, and documentation skills.
- Organization & Accuracy: Exceptional attention to detail, time management, and ability to manage multiple client deliverables simultaneously.
- Communication & Collaboration: Strong interpersonal skills with the ability to engage stakeholders, ask the right questions, and work effectively with technical teams.
- Problem-Solving: Ability to identify compliance gaps, evaluate processes, and recommend practical, risk-based improvements.
Qualifications
- 3+ years of experience in Governance, Risk, and Compliance, Business Analysis within a compliance environment, or a related role.
- Required: Practical working knowledge of SOC 2 and ISO 27001, including their control requirements and associated policies and procedures.
- Required: Demonstrated experience independently writing and maintaining compliance policies, procedures, and control documentation.
- Experience conducting compliance gap assessments, gathering requirements, and documenting business processes.
- Experience supporting compliance readiness, internal audits, or external audit preparation.
- Familiarity with additional frameworks such as HIPAA, NIST, ISO 42001, or ISO 22301 is an asset.
- Experience with GRC platforms such as Vanta, Secureframe, or Drata is an asset.
- Strong proficiency with Microsoft Office or Google Workspace and document management tools.
Why Join GRC Concierge?
We're building something different in the cybersecurity and compliance space.
Our goal is to deliver the expertise of a traditional GRC consultancy with the attentiveness and experience of a five-star concierge service.
You'll join a collaborative team where your work directly contributes to helping organizations build stronger compliance programs.
This is an opportunity to apply your GRC expertise across a variety of industries and compliance frameworks while contributing to a growing company that's redefining how compliance services are delivered.
