Cybersecurity Analyst - Governance Risk Compliance (GRC)

Zions Bancorporation•Midvale, UT

23h•Hybrid

About The Position

Zions Bancorporation is seeking a Cybersecurity Analyst - Governance Risk Compliance (GRC) to join their Enterprise Information Security team. The role focuses on driving an enterprise-wide Cybersecurity Awareness culture by reducing human risk through designing engaging security education, managing threat simulations, and promoting proactive security behaviors across the organization.

Requirements

Bachelor’s degree in computer science, Information Technology, Cybersecurity, Communications, Human Resources, Instructional Design (other degrees will be considered), or a related field; or equivalent practical experience.
2–4 years of experience in information security, training development, corporate communications, or instructional design (preferably within an IT or cybersecurity context).
Strong organizational skills with the ability to manage multiple campaigns and projects simultaneously.
Always looking for fun, memorable, and novel ways to keep security top-of-mind.
Uses data and metrics to guide decisions and improve training efforts over time.
Able to build strong relationships across Information Security teams, Risk Management, HR, Corporate Communications, and IT.
Basic understanding of risk management disciplines.
Basic understanding of core cybersecurity concepts, threats (phishing, social engineering, malware), and standard security controls.
Knowledge of adult learning theory and experience creating engaging digital content.
Exceptional written and verbal communication skills. Ability to translate complex, highly technical concepts into engaging, easy-to-understand language for a non-technical audience.

Nice To Haves

Certifications such as, but not limited to: Security Awareness Practitioner (CSAP) or SANS Security Awareness Professional (SSAP) or CompTIA Security+ Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM) or ISC2 CC
Understanding of banking industry including laws and regulations

Responsibilities

Design, coordinate, and execute security awareness training that is both precise and entertaining while effectively reducing behavior risk.
Curate and tailor security training for specific audiences, such as Information Security teams, developers, system administrators, people leaders, and executive leadership.
Understand adult learning theory with ability to simplify complex subjects into easy-to-understand material with a focus on visual aids.
Maintain relevant cybersecurity knowledge and collaborate with cyber threat intel and incident response partners for understanding and inclusion of real and emerging threats as part of delivering relevant simulation exercises.
Analyze simulation results to identify high-risk user groups and individuals.
Recommend and develop "just-in-time" learning content.
Maintain existing Cybersecurity Awareness intranet site and use it to distribute cybersecurity communications, articles, and curated content explaining security best practices in simple, non-technical language.
Act as a security advocate, fostering a supportive, "no-blame" reporting culture where employees feel comfortable reporting security concerns.
Act as a voice for the Cybersecurity team, reviewing and editing departmental and company communications.
Facilitate and participate in Cybersecurity Ambassadors with representatives across the organization, creating a bridge between business units and cybersecurity.
Recommend and understand Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) to measure the effectiveness of the training and awareness program beyond training completion metrics.
Use behavioral data to continuously refine and adapt the training strategy.
Other duties as assigned.