Senior Cybersecurity GRC Analyst

Job Description

Job Description

About the Role

We are seeking an experienced Senior Cybersecurity GRC Analyst to lead cybersecurity governance, risk, and compliance initiatives across the organization. This individual will be responsible for managing compliance programs, conducting risk assessments, leading audits, overseeing identity and access governance, and driving third-party risk management activities.

Key Responsibilities

Governance, Risk & Compliance

• Develop and manage enterprise cybersecurity compliance programs aligned with SOC 2, ISO 27001, NIST 800-53, NIST 800-171, CIS Controls, CMMC, and other regulatory frameworks.
• Partner with Security Operations and IT teams to ensure security controls are properly implemented and operating effectively.
• Lead internal and external cybersecurity audits, including audit preparation, evidence collection, remediation tracking, and reporting.
• Develop executive-level compliance dashboards, metrics, and security reports.

Risk Management

• Conduct enterprise-wide cybersecurity risk assessments and identify control gaps.
• Maintain and manage the Corporate Risk Register.
• Perform qualitative and quantitative risk analysis to support business and security decision-making.
• Develop mitigation strategies and monitor risk treatment plans.

Identity & Access Governance

• Lead quarterly User Access Reviews (UARs) and monthly user activity reviews.
• Ensure compliance with audit requirements through accurate documentation and review processes.
• Analyze privileged access and recommend RBAC and Least Privilege improvements.
• Collaborate with business and technical stakeholders to strengthen identity governance processes.

Third-Party Risk Management

• Manage vendor security assessments and Third-Party Risk Management (TPRM) activities.
• Evaluate vendor compliance with organizational security standards and regulatory requirements.
• Track remediation activities and risk mitigation plans for third-party providers.

Policy & Process Management

• Develop, maintain, and update cybersecurity policies, standards, and SOPs.
• Support Change Management processes to ensure security and compliance during system and infrastructure changes.
• Drive continuous improvement initiatives across governance and compliance functions.

Required Qualifications

• 10+ years of experience managing cybersecurity governance, risk, and compliance programs.
• Strong hands-on experience with SOC 2 audits and compliance programs.
• Deep understanding of IT security controls and cybersecurity governance practices.
• Expert knowledge of:
• NIST 800-53
• NIST 800-171
• ISO 27001
• CIS Controls v8.1
• CMMC
• FedRAMP
• Experience conducting cybersecurity risk assessments and maintaining risk registers.
• Strong understanding of Identity & Access Management (IAM), User Access Reviews (UARs), and RBAC principles.
• Experience leading internal and external audits from planning through remediation.
• Excellent analytical, documentation, and stakeholder management skills.

Preferred Qualifications

• CISSP, CISM, CISA, or related cybersecurity certifications.
• Experience with Third-Party Risk Management (TPRM) programs.
• Strong executive communication and presentation skills.
• Ability to translate complex technical concepts for non-technical audiences.
• Experience working in highly regulated environments.