IT GRC Analyst

Introduction

The IT GRC Analyst will be central to delivering Numata’s GRC service offering to clients. This role ensures that client IT environments, systems, and processes are aligned with best practice governance frameworks, regulatory requirements, and contractual obligations. By providing expert guidance on risk identification, assessment, and mitigation, the IT GRC Analyst helps clients strengthen their governance posture and reduce exposure to threats. Acting as a trusted advisor, the role bridges technology, compliance, and business needs, supporting clients in achieving secure, resilient, and compliant operations.

Duties & Responsibilities

Governance & Policy Management

• Develop, implement, and maintain IT governance frameworks, policies, standards, and procedures.

• Ensure IT policies remain aligned with business strategy, regulatory obligations, and industry standards.

• Facilitate regular policy reviews and approvals, ensuring updates reflect changes in laws, risks, or technology.

• Support executive leadership with governance reporting, dashboards, and decision-making inputs.

• Ensure accountability by mapping roles and responsibilities within governance processes.

Risk Management

• Conduct IT and cybersecurity risk assessments across systems, vendors, and projects.

• Maintain and continuously update the enterprise IT risk register.

• Identify, evaluate, and prioritize risks; recommend mitigation strategies and track remediation.

• Facilitate risk workshops and awareness sessions with business and IT stakeholders.

• Ensure IT risk considerations are integrated into project management, system development, and change management.

• Support the business in developing and maintaining business continuity and disaster recovery plans.

Compliance & Audit

• Monitor compliance with local and international regulations (e.g., POPIA, GDPR).

• Support certification and regulatory audits (internal, external, client-driven).

• Collect, validate, and maintain evidence of compliance for audit readiness.

• Identify compliance gaps and ensure corrective actions are documented and implemented.

• Maintain a compliance calendar to track obligations, assessments, and audit deadlines.

• Ensure contracts, SLAs, and vendor engagements include compliance and security requirements.

Security & Control Assurance

• Support the design, implementation, and maintenance of IT and cybersecurity controls.

• Conduct regular control testing and assurance reviews to validate effectiveness.

• Monitor IT systems and processes for adherence to policies and standards.

• Collaborate with the Security Operations team to review incidents and ensure lessons learned are fed into controls.

• Participate in system design and change reviews to ensure security and compliance requirements are met.

• Assist in developing and rolling out IT security awareness and training programs.

Vendor, Third-Party, and Data Governance

• Assess third-party and vendor risk, including due diligence, onboarding, and periodic reviews.

• Ensure data protection clauses and security controls are embedded in vendor agreements.

• Conduct vendor compliance assessments to validate adherence to Numata’s standards.

• Monitor data handling practices to ensure protection of personal and sensitive information.

Reporting & Communication

• Prepare and deliver governance, risk, and compliance reports to senior leadership.

• Provide dashboards, metrics, and key risk indicators (KRIs/KPIs) for management decision-making.

• Serve as a point of contact for internal stakeholders, auditors, and regulators on GRC-related matters.

• Communicate risk and compliance requirements in business-friendly language to ensure adoption.

Continuous Improvement

• Stay updated with evolving regulatory requirements, industry frameworks, and emerging threats.

• Recommend enhancements to governance, risk, and compliance processes.

• Identify opportunities to automate or streamline GRC reporting and monitoring.

Contribute to a culture of continuous improvement within IT and across the business.

Desired Experience & Qualification

Knowledge Requirements

• Strong understanding of IT governance frameworks (COBIT, ITIL).

• Knowledge of information security management systems (ISO 27001, NIST CSF).

• Familiarity with data privacy regulations (POPIA, GDPR).

• Understanding of IT risk management principles and methodologies.

• Knowledge of IT audit processes and control frameworks.

Skills Requirements

• Strong analytical and problem-solving skills.

• Excellent written and verbal communication skills.

• Ability to translate technical risks into business impacts.

• Skilled in documentation, reporting, and policy development.

• Strong organizational and time-management skills.

Experience Level Required

• 3–5 years of experience in IT GRC, or related IT audit/assurance role.

• Experience working with regulatory compliance frameworks and audits.

• Experience in risk assessment methodologies and risk registers.

• Exposure to enterprise IT environments and cybersecurity operations.

Competency Requirements

• Attention to detail and accuracy in documentation.

• Ability to work cross-functionally with IT, business, and external stakeholders.

• Sound judgment and decision-making in risk and compliance contexts.

• Proactive and adaptable in addressing evolving risks and requirements.

Behavioural Requirements

• Integrity and confidentiality in handling sensitive information.

• Professionalism and accountability in all interactions.

• Strong sense of ownership and responsibility.

• Ability to work independently and collaboratively within a team.

• Continuous learner with a drive for professional development.

Qualifications / Certifications

• Bachelor’s degree in Information Technology, Computer Science, Risk Management, or related field.

• Relevant certifications preferred, such as:

• CISA (Certified Information Systems Auditor)

• CRISC (Certified in Risk and Information Systems Control)

• CGEIT (Certified in the Governance of Enterprise IT)

• ISO 27001 Lead Implementer / Auditor

CompTIA Security+ or CISSP (advantageous)

Our Value to You

At Numata, we’re not just a global IT services company, we are the #1 Business Technology Strategists for SMEs, and a people-first business that believes in the power of growth, support, and shared success. Our mission is to create a dynamic, empowering workplace where innovation meets integrity, and where every individual can thrive personally and professionally.

We believe your growth is our growth. That’s why we fund training and development programs, helping you gain certifications and build new skills without the financial burden. With career pathways and opportunities to promote from within, your potential at Numata knows no limits. As part of a globally recognized and rapidly scaling business, you’ll gain exposure to cutting-edge experiences. This isn’t just a job; it’s your gateway to a world of opportunity.

We equip our team with world-class tools and infrastructure, whether you're working remotely or from our offices. With premium IT support and the latest tech, we make it easy for you to do your best work, every day. Our offices are more than just places to work; they’re environments designed to energize and inspire. Enjoy fresh fruit, premium coffee, popcorn, vending machine, secure parking, and a space built around people’s needs and comfort. It’s truly a home away from home!

At Numata, integrity, honesty, respect, and trust are more than just words, they’re values we live by. We foster a collaborative, team-first environment with open-door leadership and real opportunities to connect, including regular initiatives like Lunch with the CEO. Got ideas? We’re listening. Innovation is everyone’s responsibility here. You’ll be empowered to share your voice, drive change, and shape the future of our business, no matter your role.

We care for our