GRC Analyst – US Compliance Focus (Karachi)

About the role

We are seeking an experienced GRC Analyst to support our US‑based clients from our Karachi office. The role is full‑time, onsite, and operates on a night shift (6 PM – 3 AM Pakistan time) to align with US business hours.

Key responsibilities

• Conduct enterprise‑level risk assessments and maintain risk registers.
• Develop and implement security policies that meet US compliance standards.
• Support compliance programs for SOC 2, NIST, CMMC, HIPAA, PCI DSS, and ISO 27001.
• Coordinate internal and external audits, including third‑party/vendor risk assessments.
• Track remediation efforts and ensure timely closure of findings.
• Assist clients in certification readiness and audit preparation.

Required profile

• Bachelor's degree in Cybersecurity, Information Security, IT, or a related field.
• 2–5 years of experience in Information Security Governance, Risk, and Compliance.
• At least one industry‑recognized certification (CISA, CISM, CISSP, CRISC, ISO/IEC 27001 Lead Auditor/Implementer, PCI‑QSA).
• Strong documentation, reporting, and client communication skills.
• Ability to work independently with US stakeholders.

Required skills

• Risk assessment methodology.
• Security policy development.
• Compliance frameworks: SOC 2, NIST, CMMC, HIPAA, PCI DSS, ISO 27001.
• Audit coordination and remediation tracking.

What we offer

• Hands‑on exposure to US‑based clients and international cybersecurity operations.
• Opportunity to learn advanced US cybersecurity practices and frameworks.
• Collaboration with experienced professionals and global teams.
• Company‑sponsored certifications and continuous professional development.
• Unlimited lab access for technical skill enhancement.