GRC Analyst Resume Example
Risk-heatmap layout: a 3×3 likelihood-impact mark, audit and control metrics and a framework-coverage table for cyber GRC analysts.
Use this example Template: GRC Analyst
Mei Ling Tan
GRC Analyst — ISO 27001, MAS TRM, SOC 2 & Third-Party Risk
meiling.tan@example.com+65 9555 7314Singaporelinkedin.com/in/meilingtan-grc
9Years in GRC
240Controls mapped
−65%Testing time
3ISACA / ISO certs
Summary
Cyber GRC analyst with 9 years in banking and SaaS. I run ISO 27001 and SOC 2 programmes, map controls to MAS TRM and NIST CSF, maintain the technology risk register and assess third-party vendors. I led a first-time SOC 2 Type II with no exceptions, cut open audit issues by 72% in a year, and automated evidence collection so control testing takes a third of the time.
Experience
Senior GRC Analyst
Grab · Singapore
Feb 2022 – Present
0SOC 2 exceptions
−72%Open audit issues
180Vendors assessed
- Run the SOC 2 Type II and ISO 27001 programmes for the payments platform across 14 control owners
- Mapped 240 controls to MAS TRM, NIST CSF and PCI DSS in one unified control library
- Built automated evidence collection from cloud and IAM logs, cutting control-testing time by 65%
- Report the top 15 technology risks to the risk committee each quarter with owners and treatment dates
Technology Risk Analyst
DBS Bank · Singapore
Jul 2019 – Jan 2022
180Vendor reviews
- Assessed 180 outsourcing and cloud vendors against MAS outsourcing guidelines and tracked remediation
- Ran annual RCSA workshops for 9 technology units and kept the risk register current
- Coordinated evidence for 3 MAS inspections and the bank's annual TRM self-assessment
IT Audit Associate
PwC · Singapore
Aug 2017 – Jun 2019
- Tested IT general controls for 11 listed clients across access, change and operations
- Drafted management letters and followed up remediation with client IT teams
- Built the team's ITGC test-script library, reused on 20+ engagements
Framework coverage
| Framework | Controls | Status |
|---|---|---|
| SOC 2 Type II | 96 | No exceptions |
| ISO/IEC 27001:2022 | 93 | Certified |
| MAS TRM | 118 | Self-assessed |
| PCI DSS v4.0 | 64 | Compliant |
| NIST CSF 2.0 | 106 | Tier 3 |
Summary example
Cyber GRC analyst with [N] years in banking and SaaS. I run ISO 27001 and SOC 2 programmes, map controls to MAS TRM and NIST CSF, maintain the technology risk register and assess third-party vendors. I led a first-time SOC 2 Type II with no exceptions, cut open audit issues by [X%] in a year, and automated evidence collection so control testing takes a third of the time.
Example bullet points for a GRC Analyst
- Run the SOC 2 Type II and ISO 27001 programmes for the payments platform across [N] control owners
- Mapped [N] controls to MAS TRM, NIST CSF and PCI DSS in one unified control library
- Built automated evidence collection from cloud and IAM logs, cutting control-testing time by [X%]
- Report the top [N] technology risks to the risk committee each quarter with owners and treatment dates
- Assessed [N] outsourcing and cloud vendors against MAS outsourcing guidelines and tracked remediation
- Ran annual RCSA workshops for [N] technology units and kept the risk register current
- Coordinated evidence for [N] MAS inspections and the bank's annual TRM self-assessment
- Tested IT general controls for [N] listed clients across access, change and operations
Replace the [brackets] with your own numbers and facts. Never claim results you didn't achieve.
Skills to include
- ISO 27001 / SOC 2
- MAS TRM / NIST CSF
- Third-party risk
- Control testing & RCSA
- ServiceNow GRC
- Vanta
- Archer
- Jira
- Python
- Power BI
Tips for a GRC Analyst resume
- Put the hard requirements recruiters screen for in the top third: ISO 27001 / SOC 2, MAS TRM / NIST CSF, Third-party risk.
- List current credentials with the issuing body, e.g. CISA, CRISC.
- Give every recent role at least one measured result — for example soc 2 exceptions.
- Match the job title in your headline to the posting where it is honest to do so.
- Run the built-in resume checker and paste the job description into the keyword match before you download.
Related: How to write a resume · Action verbs · All templates