GRC Analyst II

About Rackspace Cyber Defence

Rackspace Cyber Defence is our next generation cyber defence and security operations capability that builds on 20+ years of securing customer environments to deliver proactive, risk-based, threat-informed and intelligence driven security services.

Our purpose is to enable our customers to defend against the evolving threat landscape across on-premises, private cloud, public cloud and multi-cloud workloads.

Our goal is to go beyond traditional security controls to deliver cloud-native, DevOps-centric and fully integrated 24x7x365 cyber defence capabilities that deliver a proactive, threat-informed, risk-based, intelligence-driven approach to detecting and responding to threats.

Our mission is to help our customers:

• Proactively detect and respond to cyber-attacks – 24x7x365.
• Defend against new and emerging risks that impact their business.
• Reduce their attack surface across private cloud, hybrid cloud, public cloud, and multi-cloud environments.
• Reduce their exposure to risks that impact their identity and brand.
• Develop operational resilience.
• Maintain compliance with legal, regulatory and compliance obligations.

What we’re looking for

We are seeking an experienced Governance, Risk, and Compliance (GRC) Analyst – Level 2 to support our Managed Cloud Security Posture Management (CSPM) services.

The ideal candidate will have hands-on experience in information security governance, risk assessments, regulatory compliance, and security control evaluations. The analyst will work closely with Cloud Security Engineers, security architects, and customer stakeholders to assess compliance posture, identify and manage risks, oversee remediation activities, and deliver actionable security and compliance reporting.

This role requires the ability to independently manage day-to-day GRC activities, interpret security assessment findings, and provide risk-based recommendations to internal team and occasionally external customers.

Key Accountabilities 

·        Conduct security risk assessments, control reviews and compliance gap analyses; translate findings into business risk and prioritized recommendations.

·        Maintain customer risk registers, control matrices, treatment plans, policy exceptions and risk-acceptance records, including approvals and expiry dates.

·        Map and assess controls against relevant frameworks such as ISO 27001, NIST CSF / 800-53, CIS Controls, SOC 2 and PCI DSS, as applicable to customer scope.

·        Coordinate remediation governance with cloud, CSPM, VMDR, SOC and infrastructure SMEs; track ownership, evidence, overdue actions and escalation through closure.

·        Prepare customer-facing risk, compliance and posture reports; lead routine GRC reviews and explain material risks to technical and nontechnical stakeholders.

·        Support audit readiness through evidence collection, control documentation, findings tracking and coordination with customer or internal auditors.

·        Improve standardized GRC reporting, assessment checklists, risk-scoring methods and service delivery procedures.

Skills & Experience

·                  Approximately 5+ years in information security GRC, risk management, compliance or control assurance roles.

·                  Practical experience with risk assessments, compliance mapping, audit evidence, risk registers and remediation follow-up.

·                  Experience in an MSSP or customer-facing managed security environment is advantageous; familiarity with cloud security and CSPM reporting tools (including Prowler) is desirable, not mandatory.

·                  Working knowledge of ISO 27001, NIST CSF, NIST 800-53, CIS Controls, SOC 2 and PCI DSS; ability to interpret controls in customer environments.

·                  Ability to understand security findings from CSPM, vulnerability management and SOC teams and assess their risk and compliance implications without administering those platforms.

·                  Strong analytical, written communication, customer presentation, stakeholder coordination and independent delivery skills. 

Desired Certifications

CRISC, CISA, CISM, ISO 27001 Lead Auditor / Lead Implementer or equivalent

Soft Skills

• Self-motivated, proactive, and customer-focused professional.
• Strong analytical, troubleshooting, and problem-solving abilities.
• Excellent organizational and time-management skills.
• Ability to prioritize multiple incidents in a fast-paced operational environment.
• Strong verbal and written communication skills with technical and non-technical stakeholders.
• Demonstrated commitment to customer satisfaction and continuous improvement.
• Ability to work independently while collaborating effectively across teams.
• Willingness to work flexible schedules and support critical customer situations.

About Rackspace Technology

Rackspace Technology is the trusted operator of the full enterprise AI stack, from governed private cloud to AI inference and agents in production. From edge to core to cloud, we operate the infrastructure, data layer, and software integration to deliver business outcomes with the predictable cost, reliability, security, and compliance that regulated and mission-critical environments demand. We support customers in more than 120 countries with AI capabilities spanning private cloud, public cloud, applications, data and cyber resilience.

More on Rackspace Technology

Though we’re all different, Rackers thrive through our connection to a central goal: to be a valued member of a winning team on an inspiring mission. We bring our whole selves to work every day. And we embrace the notion that unique perspectives fuel innovation and enable us to best serve our customers and communities around the globe. We welcome you to apply today and want you to know that we are committed to offering equal employment opportunity without regard to age, color, disability, gender reassignment or identity or expression, genetic information, marital or civil partner status, pregnancy or maternity status, military or veteran status, nationality, ethnic or national origin, race, religion or belief, sexual orientation, or any legally protected characteristic. If you have a disability or special need that requires accommodation, please let us know.