Senior Governance, Risk & Compliance Analyst

Senior Governance, Risk & Compliance Analyst

Tampa, FL | Hybrid Schedule | Full-Time

We are seeking an experienced Senior Governance, Risk & Compliance Analyst to help lead and advance an enterprise cybersecurity GRC program. This position is ideal for someone who combines hands-on PCI compliance expertise with the ability to establish governance standards, identify control gaps, coordinate audit activities, and influence business stakeholders across the organization.

This is a cybersecurity risk and governance role , rather than a general enterprise risk or audit-execution position. The successful candidate will take ownership of program-level initiatives and help ensure cybersecurity policies, controls, and standards are understood, implemented, and maintained throughout the business.

What You’ll Do

• Lead and continuously improve the enterprise cybersecurity GRC program.
• Develop, maintain, and communicate cybersecurity governance policies, procedures, controls, and data-governance standards.
• Support PCI compliance initiatives within an environment that processes consumer payment-card data.
• Assess the adequacy of security controls across information systems and technology environments.
• Identify cybersecurity control, policy, and governance gaps and recommend practical remediation strategies.
• Partner with internal and external auditors to coordinate IT audits, risk assessments, compliance activities, and remediation efforts.
• Support compliance initiatives involving PCI DSS, SOC 1, SOC 2, ISO 27001, SOX, and ITGC controls .
• Conduct cybersecurity assessments of third-party vendors, suppliers, and cloud-service providers.
• Track third-party risks, trends, findings, and remediation activities while supporting executive-level reporting.
• Communicate cybersecurity requirements to technical teams, finance, and other business functions.
• Build stakeholder support for new or updated controls and hold appropriate teams accountable for implementation.
• Support security-awareness training, testing, reporting, and employee education.
• Collaborate across technical and business teams to strengthen the organization’s overall cybersecurity risk posture.

What We’re Looking For

• Approximately 5–10 years of relevant experience in information security, cybersecurity governance, risk management, compliance, IT auditing, or risk analysis.
• Demonstrated experience owning, developing, implementing, or advancing an enterprise cybersecurity GRC program .
• Meaningful, hands-on experience leading or supporting PCI compliance programs .
• Experience working with internal and external auditors and coordinating audits, assessments, findings, and remediation efforts.
• Working knowledge of frameworks and standards such as PCI DSS, SOC 1, SOC 2, ISO 27001, SOX, and ITGC .
• Experience assessing third-party cybersecurity risk and recommending appropriate controls or corrective actions.
• Strong background developing and implementing security or data-governance policies, procedures, frameworks, and standards.
• Ability to translate cybersecurity requirements into practical business actions.
• Demonstrated success influencing stakeholders and driving adoption without relying on direct reporting authority.
• Strong project-management, change-management, critical-thinking, communication, and presentation skills.
• Ability to work effectively across technical, audit, finance, and business teams.
• Bachelor’s degree in Business, Information Management, Computer Science, Data Analytics, or a related discipline.

Preferred Qualifications

• Experience within a consumer-facing environment involving significant payment-card activity, such as:
• Restaurants or hospitality
• Retail
• Food and beverage
• Entertainment
• Consumer packaged goods
• Experience with Microsoft Azure or another cloud platform.
• Experience managing security-awareness training, testing, and reporting.
• One or more relevant certifications, including CISA, CISM, CRISC, CISSP, or PCIP .

Work Arrangement

• Location: Tampa, Florida, near Tampa International Airport
• Schedule: Hybrid, currently presented as three days onsite and two days remote
• The onsite schedule offers some flexibility, with Monday or Friday generally preferred as office days. The hybrid policy remains subject to change as organizational needs evolve.

Compensation and Benefits

• Base salary: Approximately $135,000 - $145,000
• Annual bonus: Up to 10%, based on company and individual performance.
• Benefits include medical, dental, vision, a 401(k) match, and additional employee benefits.

Ideal Candidate

The strongest candidate will be able to demonstrate how they have personally led a PCI compliance initiative, advanced an enterprise cybersecurity GRC program, partnered with auditors, addressed third-party cyber risk, and persuaded business stakeholders to implement required controls.

General audit or compliance experience alone will not be sufficient. The position requires someone who can own the program, identify gaps, establish standards, and drive organizational follow-through .

Interested?

If your background includes enterprise GRC program ownership, hands-on PCI compliance, cybersecurity risk management, and cross-functional stakeholder influence, please apply or contact the recruiter directly for a confidential conversation.

“Benefit offerings include medical, dental, vision, life insurance, short-term disability, additional voluntary benefits,

EAP program, commuter benefits, and 401K plan. Our program provides employees the flexibility to choose the type

of coverage that meets their individual needs. Available paid leave may include Paid Sick Leave, where required by

law; any other paid leave required by Federal, State, or local law; and Holiday pay upon meeting eligibility criteria.”

“Equal Opportunity Employer/Veterans/Disabled

To read our Candidate Privacy Information Statement, which explains how we will use your information, please navigate to

The Company will consider qualified applicants with arrest and conviction records in accordance with federal, state, and local laws and/or security clearance requirements, including, as applicable:

• The California Fair Chance Act

• Los Angeles City Fair Chance Ordinance

• Los Angeles County Fair Chance Ordinance for Employers

• San Francisco Fair Chance Ordinance”