Cybersecurity Controls Assurance & GRC Automation Analyst

Blue Cross and Blue Shield of Nebraska•Omaha, NE

1d•Hybrid

About The Position

At Blue Cross and Blue Shield of Nebraska (BCBSNE), we are a mission-driven organization dedicated to championing the health and well-being of our members and the communities we serve. This role will help shape how BCBSNE validates, measures, and strengthens cybersecurity controls across a modern, highly regulated technology environment. You will perform risk-based control assessments that go beyond checklist compliance, evaluating whether controls are well designed, properly implemented, operating effectively, and supported by strong evidence. Your work will connect technical security testing with practical risk insight, helping the organization understand where defenses are strong, where gaps exist, and how to prioritize meaningful improvements. You will work hands-on with emerging, automated penetration testing and attack simulation platforms, and with cloud, identity, endpoint, network, infrastructure, application, vulnerability management, and data-protection systems to validate security posture, identify misconfigurations and control failures, assess attack paths, and recommend practical remediation. You will also support GRC and continuous-control-monitoring capabilities, including automated evidence collection, control testing, remediation tracking, risk management processes, dashboards, metrics, and reporting that make cybersecurity risk easier to see, explain, and act on. This is an opportunity for a cyber/GRC analyst who enjoys bridging technical exploration with governance impact. You will partner with cybersecurity, technology, risk, audit, and business teams to investigate issues, support audits and regulatory reviews, participate in approved validation activities such as configuration testing, vulnerability and exploitability validation, attack-path analysis, and purple-team exercises, and help turn findings into improvements that strengthen BCBSNE’s cyber resilience and protect the members and communities we serve.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, or related field, or equivalent experience.
Three to five years of experience in cybersecurity assurance, security operations, cybersecurity engineering, penetration testing, IT audit, GRC, risk management, or related experience.
Experience performing cybersecurity control testing, technical assessments, configuration reviews, vulnerability validation, or security assessments.
Working knowledge of cybersecurity frameworks such as NIST, CIS Controls, HITRUST, HIPAA, or ISO 27001.
Experience interpreting technical evidence and translating cybersecurity findings into practical risk and remediation recommendations.
Ability to communicate technical cybersecurity issues clearly to both technical teams and non-technical stakeholders.

Nice To Haves

Experience with GRC or continuous-control-monitoring processes platforms.
Experience with penetration testing, red/purple teaming, attack-path analysis, or adversary-informed testing.
Knowledge of MITRE ATT&CK and cloud, identity, network, and endpoint security concepts.
Experience in healthcare, financial services, or another highly regulated industry.
Relevant certifications such as CISSP, CISM, CISA, CRISC, CGRC, Security+, OSCP, or similar.
Experience developing or improving cyber risk metrics, GRC dashboards, or executive-ready reporting.
Comfort using automation, scripting, or workflow tools to streamline evidence collection, control testing, or remediation tracking.

Responsibilities

Perform risk-based control assessments that go beyond checklist compliance—evaluating whether controls are well designed, properly implemented, operating effectively, and supported by strong evidence.
Connect technical security testing with practical risk insight, helping the organization understand where defenses are strong, where gaps exist, and how to prioritize meaningful improvements.
Work hands-on with emerging, automated penetration testing and attack simulation platforms, and with cloud, identity, endpoint, network, infrastructure, application, vulnerability management, and data-protection systems to validate security posture, identify misconfigurations and control failures, assess attack paths, and recommend practical remediation.
Support GRC and continuous-control-monitoring capabilities, including automated evidence collection, control testing, remediation tracking, risk management processes, dashboards, metrics, and reporting.
Partner with cybersecurity, technology, risk, audit, and business teams to investigate issues.
Support audits and regulatory reviews.
Participate in approved validation activities such as configuration testing, vulnerability and exploitability validation, attack-path analysis, and purple-team exercises.
Help turn findings into improvements that strengthen BCBSNE’s cyber resilience and protect the members and communities we serve.