Dear Hiring Manager,
I am applying for the GRC Analyst role. Your post asks for risk assessment, audit evidence and knowledge of ISO 27001, which is the work I do every week in the internal audit team of a bank.
Before our last ISO 27001 surveillance audit I collected evidence for forty controls and closed six gaps before the auditor arrived. I keep a risk register of sixty risks and follow up fourteen overdue actions with their owners. I also reviewed ten vendor questionnaires against PCI DSS and reported three open items. Outside work I wrote six one-page policies and a risk register template that anyone can reuse.
I hold CompTIA Security+ and ISO 27001 Foundation. I would like to take on more of the risk work and learn from your senior analysts, and I can bring my templates to an interview.
Sincerely,
Morgan Example