GRC Analyst

Busey Bank•Leawood, KS

8h•Onsite

About The Position

The GRC Analyst is responsible for ensuring that Busey Bank implements, manages, and enforces information security and cybersecurity controls to effectively align to industry standards. This position will monitor the performance of key Information Security and Information Technology processes and controls, lead projects, drive change, and administer technical systems designed to maintain the confidentiality, integrity, and availability of all organizational information systems and assets.

Requirements

Knowledge of security concepts such as Microsoft Azure and Microsoft 365 computing environments.
Project management experience, leading small to mid-size implementations and changes.
General knowledge of cybersecurity and information security metrics reporting.
Proficient technical skills in Microsoft Office (Word, Excel, PowerPoint), Microsoft 365 Copilot.
Ability to conduct information security training of end users both in person and remotely.
Self-starter motivated to produce results, meet all established goals, objectives, and expectations as well as willingness to expand skills as the Bank’s technology platform expands.
At least 3 years of work experience, preferred Bachelor’s Degree, or equivalent work experience preferred.

Nice To Haves

Strong analytical and reporting skills; experience with Power BI or Tableau is a plus.
Security certifications such as CGRC, CISA, CRISC, or similar are welcomed.

Responsibilities

Administer and optimize SailPoint IdentityNow for identity lifecycle management.
Support access provisioning, de-provisioning, and role-based access control (RBAC).
Lead access certification campaigns and ensure audit readiness.
Coordinate and execute periodic user access reviews across critical systems.
Collaborate with business and IT stakeholders to validate access appropriateness.
Monitor, Track and remediate access violations and provide audit documentation.
Oversee the completion of information technology and security risk assessments leveraging common industry frameworks such as Center for Internet Security (CIS), Cyber Risk Institute (CRI), or NIST.
Document risks, recommend mitigation strategies, and track remediation.
Define, track, and report on key performance and risk indicators (KPIs/KRIs).
Build dashboards and executive reports to communicate risk trends and control effectiveness.
Partner with stakeholders to improve data quality and decision-making.
Maintain and enhance the enterprise control framework and process taxonomy.
Map controls, risks, policies, and regulatory requirements.
Support control rationalization and harmonization across business units.
Develop and deliver engaging security awareness training tailored to various audiences.
Manage phishing simulation campaigns and analyze user behavior trends.
Provide targeted follow-up training and report on program effectiveness
Provide input on enhancements to security posture of the Bank through configuration changes and new product recommendations.
Lead Information Security projects as assigned.
Assist with the review and evaluation of information security aspects of third-party service providers, contractors, and other suppliers who have access to company and customer information and systems.
Assist with the collection of documentation for audits and regulatory examinations.
Develop and maintain trusted, positive relationships with associates, auditors, examiners & vendors.