Analyst, Cybersecurity Governance, Risk and Compliance

Austin Community College•Austin, TX

2d•$83,665 - $105,783

About The Position

The GRC Analyst works under the supervision of the Cybersecurity Operations Manager as part of the Governance, Risk, and Compliance team. The role supports compliance with regulatory frameworks, risk management, and organizational governance, and advises staff and leadership on information security policy development, implementation, interpretation, and compliance. The Analyst also helps foster a security-first culture through training and awareness programs. The position focuses on policy drafting and lifecycle management, NIST/TCF control assessments, audit coordination, System Security Plans, and regulatory compliance mapping and tracking. The Analyst supports security controls assessments, continuous monitoring, risk exposure analysis, exception management, remediation, third-party supplier risk assessments, and security and privacy training. The work is performed in a standard office or similar environment. Employees must maintain a domicile in Texas while employed. Candidates must be legally authorized to work in the United States without employer sponsorship.

Requirements

At least one year of experience working in the technology industry.
Bachelor's degree in computer science, Information Technology, or a related field; alternatively, four years of related work experience or an Associate's degree plus two years of related work experience may substitute for the degree requirement.
Working knowledge of security frameworks, primarily NIST.
Knowledge of information security management, governance, and compliance principles, practices, laws, rules, and regulations.
Knowledge of information technology systems and processes, network infrastructure, and data architecture.
Knowledge of security training and awareness best practices.
Skills or experience developing or delivering security awareness training directly or through managed third-party providers or tools.
Skills in business process mapping and documentation, and policy and procedure development.
Recent information security experience and up-to-date knowledge of the current threat landscape.
Analytical and conceptual thinking skills and strategic planning skills.
Ability to proactively work through technical solutions to open-ended problems.
Effective interpersonal and communication skills, including strong oral and written communication and the ability to work with people across disciplines and levels of technical expertise.
Organizational and planning skills, attention to detail, and follow-through.
Ability to establish and maintain effective working relationships, including coordinating the work of others.
Ability to prioritize assignments while working on multiple projects.
Valid Texas driver's license and reliable transportation for travel in the Austin area as required.
Ability to perform essential job functions, with or without reasonable accommodation.
Legally authorized to work in the United States without employer sponsorship.

Nice To Haves

Experience specifically in cybersecurity governance, risk, and compliance or related roles.
Experience in a Texas government or government-adjacent organization.
Experience in an institution subject to FERPA.
Working knowledge of data privacy regulations, including FERPA requirements or similar regulated data classifications.
ITIL Foundation-level certification or above.
Relevant certifications such as CISSP, CISA, or CRISC.

Responsibilities

Assist with System Security Plans, continuous monitoring, Plans of Action and Milestones, security controls assessments, and risk exposure analysis in accordance with TCF/NIST requirements.
Research, recommend, and contribute to information security policies, standards, and procedures; assist with lifecycle management of policies and supporting documents.
Manage the exception review and approval process, ensuring exceptions are documented and periodically reviewed.
Update security controls and support stakeholders on controls for internal assessments, regulatory requirements, and protection of FERPA and personally identifying information (PII).
Assist with and perform IT security control effectiveness reviews; manage remediation of identified gaps and assess newly implemented or enhanced controls.
Collaborate with internal teams to assess information security policies, procedures, and controls for compliance with applicable regulations and standards.
Prepare reports on assessment findings, monitor status updates, and ensure corrective actions are implemented effectively and sustainably.
Create information security and cyber awareness communications and training content for employees.
Support development and maintenance of a measured, role-tailored Security and Privacy training program, including oversight of phishing campaigns.
Monitor security industry trends, emerging threats, regulatory compliance requirements, and security best practices.
Participate in cross-functional projects related to risk management, data protection, and security governance.
Conduct third-party supplier risk assessments across the supplier lifecycle; evaluate and communicate business risks and benefits, and enforce supplier compliance mandates.
Maintain an established work schedule, protect confidential work-related information and materials, and coordinate effectively with others.
Follow safety rules, report unsafe conditions or behavior, and take reasonable actions to prevent unsafe practices.