Analyst, Cybersecurity Governance, Risk and Compliance

Austin Community College District•Highland, CA

19h

About The Position

The GRC Analyst works under the supervision of the Cybersecurity Operations Manager as part of the Governance, Risk and Compliance team. The position helps ensure adherence to regulatory frameworks, manage organizational risks, and uphold governance standards. It provides staff and leadership with expertise in information security policy development, implementation, interpretation, and compliance, and supports a security-first culture through training and awareness programs. The role focuses on policy drafting and lifecycle management, NIST/TCF control assessments, audit coordination, System Security Plans, and regulatory compliance mapping and tracking. The analyst supports security controls assessments, continuous monitoring, risk exposure analysis, remediation, reporting, security and privacy training, and third-party supplier risk assessments. The position requires legal authorization to work in the United States without employer sponsorship. Work is performed in a standard office or similar environment, with travel in the Austin area as required.

Requirements

Bachelor’s degree in computer science, Information Technology, or a related field; alternatively, an Associate’s degree plus two years of related work experience may be substituted for the education requirement, in addition to the required experience noted in the posting.
One year of experience working in the technology industry.
Working knowledge of security frameworks, primarily NIST.
Knowledge of information security management, governance, and compliance principles, practices, laws, rules, and regulations.
Knowledge of information technology systems and processes, network infrastructure, and data architecture.
Knowledge of security training and awareness best practices.
Skills or experience developing and delivering security awareness training, directly or through managed third-party providers or tools.
Skills in business process mapping and documentation and in policy and procedure development.
Recent information security experience and up-to-date knowledge of the threat landscape.
Analytical, conceptual thinking, and strategic planning skills.
Ability to proactively develop technical solutions to open-ended problems.
Effective interpersonal, oral and written communication skills, including the ability to work with people from different disciplines and levels of technical expertise.
Organizational and planning skills, attention to detail, and follow-through.
Ability to maintain confidentiality of work-related information and materials.
Ability to establish and maintain effective working relationships and coordinate the work of others.
Ability to prioritize assignments while working on multiple projects.
Valid Texas driver’s license and reliable transportation for travel in the Austin area as required.
Legally authorized to work in the United States without employer sponsorship; the College does not sponsor employment visas or support employment-based immigration petitions for this position.

Nice To Haves

Work experience specifically in cybersecurity governance, risk and compliance or related roles.
Work experience in a Texas government or government-adjacent organization.
Work experience in a FERPA-regulated institution.
Working knowledge of data privacy regulations, including FERPA requirements or similar regulated data classifications.
ITIL Foundation-level certification or above.
Relevant certifications such as CISSP, CISA, or CRISC.

Responsibilities

Assist with developing System Security Plans, continuous monitoring, Plans of Action and Milestones, security controls assessments, and risk exposure analyses in accordance with TCF/NIST requirements.
Research, recommend, and contribute to the development of information security policies, standards, and procedures.
Assist with lifecycle management of information security policies and supporting documents.
Manage the exception review and approval process, ensuring exceptions are documented and periodically reviewed.
Update security controls and support stakeholders on controls related to internal assessments, regulations, and protection of FERPA data and personally identifying information (PII).
Assist with and perform IT security control effectiveness reviews.
Manage remediation efforts for identified gaps, including assessment of newly implemented or enhanced controls.
Collaborate with internal teams to assess information security policies, procedures, and controls for compliance with applicable regulations and standards.
Prepare reports on assessment findings, monitor status updates, and ensure corrective actions are implemented effectively and sustainably.
Create information security and cyber awareness communications and training content for employees.
Support development and maintenance of a measured, managed, role-tailored Security and Privacy training program, including oversight of phishing campaigns.
Keep abreast of security industry trends, emerging threats, regulatory compliance requirements, and security best practices.
Participate in cross-functional projects related to risk management, data protection, and security governance.
Conduct third-party supplier risk assessments across the supplier lifecycle, evaluate and communicate business risks and benefits, and enforce supplier compliance mandates.
Maintain an established work schedule, maintain confidentiality, prioritize multiple assignments, and establish effective working relationships, including coordinating the work of others.
Work safely, follow safety rules, report unsafe conditions or behavior, and take reasonable actions to prevent unsafe practices.