Security Analyst - GRC

About Information Security Team

Our mission is to create and maintain a secure foundation for Bridgestone to continue serving society with superior quality and trust in a digital and evolving world. We will Identify, Detect, Protect, Respond and Recover from cyber-attacks, ensuring the Confidentiality, Integrity, Availability and Safety of our team-mates, information, and systems.

Years of experience : 5-7 years

Key Responsibilities

• Support Governance, Risk, and Compliance (GRC) programs and initiatives across global regions.
• 50% Security Awareness support, 50% all other GRC duties as assigned
• Assist with compliance assessments, evidence collection, control testing, and audit activities supporting frameworks and regulations such as ISO 27001, NIST, PCI DSS, NIS2, TISAX, GDPR, CMMC, and other applicable requirements.
• Support enterprise risk management activities, including risk identification, assessment, treatment planning, risk register maintenance, and risk reporting.
• Develop, review, maintain, and organize Information Security policies, standards, procedures, and supporting documentation.
• Support security awareness and training activities, including awareness campaigns, communications, phishing simulations, metrics collection, and employee engagement initiatives.
• Prepare reports, dashboards, metrics, and presentations for leadership, auditors, and stakeholders. Specifically phishing metrics and reporting.
• Monitor regulatory, legal, and industry developments impacting cybersecurity and compliance obligations.
• Support continuous improvement initiatives related to GRC processes, tools, documentation, and reporting.

Technical Skills

• Understanding of Information Security Governance, Risk Management, Compliance, and Security Awareness principles.
• Familiarity with security frameworks and standards including ISO 27001, NIST CSF, NIST 800-53, CIS Controls, PCI DSS, GDPR, NIS2, TISAX, and similar requirements.
• Experience supporting audits, assessments, control reviews, and documentation management.
• Familiarity with risk management methodologies and risk assessment processes.
• Experience using governance, risk, compliance, issue management, and workflow platforms such as ServiceNow, OneTrust, Archer, Sprinto, or similar tools.
• Ability to analyze information, develop reports, track metrics, and identify trends.
• Proficiency with Microsoft Office products including Excel, PowerPoint, Word, Teams, and SharePoint.

Soft Skills

• Strong verbal and written communication and interpersonal skills. (in English)
• Excellent troubleshooting and problem-solving skills
• Solid business acumen; understands how Information Security supports business objectives.
• Comfortable dealing with ambiguity and working through change.
• Works well on a team; supplemented by the ability to work with minimal supervision.

Educations And Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Business, Risk Management, Audit, Compliance, or a related discipline.
• Relevant certifications preferred, such as Security+, ISO 27001 Lead Implementer/Auditor, CISA, CRISC, CISSP, CISM, CGRC, or similar credentials.
• Equivalent combination of experience, training, and education may be considered.