Lead Security Analyst

Job_Description":"

The GRC Analyst/Lead supports the organizations governance, risk management, and compliance (GRC) programs by assisting with control design and testing, risk assessments, policy management, third party risk management and vendor assessment, and regulatory compliance activities. This role works closely with global stakeholders across IT, Security, Legal, Privacy, and Internal Audit to ensure adherence to internal policies, industry frameworks, and regulatory requirements. This role should be able to work independently and should be used to Global collaboration; the Staples GRC function is lead out of Staples US Corporate and this role will serve as an extension of such team to provide coverage to the India office.

Governance Policy Management

• **- Support the lifecycle management of information security, privacy, and risk management policies (drafting, review, approvals, communication, and periodic refresh).

Maintain policy repositories and ensure alignment with applicable frameworks and regulatory requirements.

Assist with governance reporting, metrics, and committee materials.

Risk Management

• Participate in enterprise and IT risk assessments, including risk identification, scoring, documentation, and tracking of mitigation plans.

Support risk workshops and coordination with business and technology teams.

Maintain risk registers and follow up on remediation activities.

Compliance Assurance

• **- Support compliance programs aligned to frameworks such as:

SOC 1 / SOC 2

ISO/IEC 27001

PCI DSS

NIST CSF / NIST 800 53 (as applicable)

Assist with internal and external audits, including evidence collection, walkthroughs, control testing, and issue tracking.

Support customer, vendor, and regulatory inquiries related to security and compliance.

Regulatory Privacy Support

• **- Assist with compliance activities related to applicable laws and regulations (e.g., India Digital Personal Data Protection Act (DPDP), GDPR, or other regional privacy requirements as applicable).

Support privacy risk assessments, data inventories, and control documentation.

Third*** Job_Description":"

The GRC Analyst/Lead supports the organizations governance, risk management, and compliance (GRC) programs by assisting with control design and testing, risk assessments, policy management, third party risk management and vendor assessment, and regulatory compliance activities. This role works closely with global stakeholders across IT, Security, Legal, Privacy, and Internal Audit to ensure adherence to internal policies, industry frameworks, and regulatory requirements. This role should be able to work independently and should be used to Global collaboration; the Staples GRC function is lead out of Staples US Corporate and this role will serve as an extension of such team to provide coverage to the India office.

Governance Policy Management

• **- Support the lifecycle management of information security, privacy, and risk management policies (drafting, review, approvals, communication, and periodic refresh).

Maintain policy repositories and ensure alignment with applicable frameworks and regulatory requirements.

Assist with governance reporting, metrics, and committee materials.

Risk Management

• Participate in enterprise and IT risk assessments, including risk identification, scoring, documentation, and tracking of mitigation plans.

Support risk workshops and coordination with business and technology teams.

Maintain risk registers and follow up on remediation activities.

Compliance Assurance

• **- Support compliance programs aligned to frameworks such as:

SOC 1 / SOC 2

ISO/IEC 27001

PCI DSS

NIST CSF / NIST 800 53 (as applicable)

Assist with internal and external audits, including evidence collection, walkthroughs, control testing, and issue tracking.

Support customer, vendor, and regulatory inquiries related to security and compliance.

Regulatory Privacy Support

• **- Assist with compliance activities related to applicable laws and regulations (e.g., India Digital Personal Data Protection Act (DPDP), GDPR, or other regional privacy requirements as applicable).

Support privacy risk assessments, data inventories, and control documentation.

Third***