Contractor job Cyber Security GRC Business Analyst (servicenow)

Your Role:

· Translate GRC process needs into ServiceNow IRM delivery: gather requirements with process owners and end users, structure them into epics/user stories, and ensure they can be implemented in a maintainable way in ServiceNow IRM.

· Cover multiple IRM modules, with focus on the operational processes and user journeys across Risk Management, Compliance / Internal Control, Audit Management.

· Cover TPRM-related use cases (vendor/engagement data, questionnaires, roles/personas, operational workflows) and ensure alignment with the broader IRM setup and governance model.

· User-driven approach: optimize workflows for end users (clarity, minimal clicks, consistent forms/workspaces, meaningful notifications), and continuously improve usability based on feedback.

· Pragmatic configuration-first mindset: prioritize out-of-the-box and configuration-driven capabilities and avoid complex customizations or heavy to maintain configurations unless there is a clear business case and long-term maintainability justification.

· Write strong user stories and acceptance criteria: ensure each story is testable, traceable to a business need, and ready for implementation by the development team (including functional specs when needed).

· Execute small changes independently in the platform, such as:

simple form/list adaptations, field behavior, minor workflow adjustments, notifications, basic reporting/dashboard tuning, and controlled update sets; while larger changes are handled by the development team (with the BA providing clarified functional intent and supporting testing).

· Support UAT and quality: define test scenarios, coordinate UAT with stakeholders, validate delivered changes vs acceptance criteria, and ensure smooth adoption.

· Contribute to sustainable data/reporting needs: ensure that the solution remains reportable and scalable (consistent object relationships, clean data capture, reusable reporting approach).

· Support TPRM-related use cases (vendor/engagement data, questionnaires, roles/personas, operational workflows) and ensure alignment with the broader IRM setup and governance model.