Governance, Risk, and Compliance (GRC) Data Analyst | Technology Services

City and County of Denver • Denver, CO

2d • $74,276 - $122,555 • Hybrid

About The Position

The Governance, Risk, and Compliance (GRC) Data Analyst is a key stakeholder on the City and County of Denver’s GRC and Data Protection Team, advancing Technology Services governance, risk, and compliance objectives across vendor risk, policy governance, audit coordination, access controls, security awareness, and broader GRC activities. The role evaluates risks and vulnerabilities from system-security, end-user, and application perspectives and serves as a GRC subject-matter expert and liaison to other City agencies.

The position manages technology vendor risk assessments, including determining review scope, coordinating with vendors and internal stakeholders, and communicating conclusions and related compliance, contract-language, approval, or denial needs. It manages Technology Services policies and standards, ensuring annual reviews and updates, advising policy stakeholders, and creating new policies or standards when needed.

The analyst serves as the primary liaison between the Auditor’s Office and Technology Services, coordinating external audits, collecting and creating deliverables, briefing leadership on status and potential findings, and advising on or drafting responses to recommendations. The role also audits system permissions, recommends appropriate access levels, and ensures administrative privileges are supported by documented business needs.

Additional responsibilities include identifying employee security-awareness training needs, coordinating training with HR and Workday Learning, monitoring completion, managing third-party file-share requests, conducting risk assessments, supporting regulatory compliance and role-based access control initiatives, and helping City agencies reduce risk. The position uses ServiceNow to manage assessments, audits, policies, and file-share permission requests.

Requirements

• Two years of experience with data protection, governance, risk assessment, and compliance with information technology systems.
• Bachelor’s degree in Information Technology or a related field, or qualifying education/experience equivalency.
• Knowledge of and experience applying NIST Cybersecurity and Privacy Frameworks.
• Knowledge of and experience applying the Payment Card Industry Data Security Standard (PCI-DSS).
• Knowledge of and experience applying HIPAA.
• Experience using Workday, OneTrust, ServiceNow, and Box platforms.
• Ability to evaluate processes, identify gaps, and implement effective, scalable improvements.
• Ability to work independently, manage priorities, and complete tasks with minimal supervision.
• Collaborative, relationship-building approach and willingness to support equity, inclusion, and continuous improvement.
• Valid work authorization that does not require visa sponsorship for employment authorization in the United States.

Nice To Haves

• Experience in policy creation, audits, and technical writing.
• A continuous-improvement mindset and initiative to identify opportunities to streamline and improve processes.
• Relevant experience may supplement education requirements.

Responsibilities

• Manage the Technology Services vendor risk assessment program, including initial and annual assessments of Citywide technology vendors.
• Determine the scope of vendor reviews, coordinate with vendors and internal stakeholders, and communicate assessment conclusions, compliance and contract-language needs, approvals, and denials.
• Manage Technology Services policies and standards, ensure annual review and updates, advise stakeholders on policy language, and create new policies or standards when needed.
• Serve as the primary liaison between the City and County of Denver Auditor’s Office and Technology Services during audit engagements.
• Coordinate external audits end to end, collect and create audit deliverables, brief Technology Services leadership on audit status and potential findings, and advise on or draft responses to audit recommendations.
• Advise Technology Services stakeholders on internal controls and safeguards in response to audit findings.
• Identify and conduct risk assessments across vendors, systems, and processes.
• Periodically audit system user permissions, recommend appropriate access levels, and ensure administrative privileges are limited to documented business needs.
• Select and manage security-awareness training materials, determine employee training needs based on behavior and risk, coordinate provision with HR and Workday Learning, and monitor completion with follow-up.
• Use ServiceNow to manage vendor risk assessments, audits, policies, and third-party file-share permission requests.
• Respond to and organize responses to third-party risk assessment requests from across the City and County of Denver.
• Approve or deny third-party file-share requests and support other GRC activities, including regulatory compliance and the role-based access control project.
• Collaborate with Technology Services teams and City agencies to mitigate identified risks and promote regulatory compliance.
• Serve as a GRC subject-matter expert and liaison to other City agencies, advising on risk-reduction and compliance best practices.

Benefits

• Guaranteed lifelong monthly pension after vesting with five years of service.
• 457B Retirement Plan.
• 140 hours of PTO earned within the first year.
• 11 paid holidays, one personal holiday, and one volunteer day per year.
• Competitive medical, dental, and vision plans effective within one month of start date.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level