Information Security GRC Analyst IV - ESH

CareSource•Dayton, OH

1d•$113,000 - $197,700

About The Position

The Information Security GRC Analyst manages day-to-day, short- and long-term information security risk and compliance programs, ensuring activities remain within risk tolerance and comply with approved policies, procedures, and standards. The role collaborates with stakeholders and customers to execute information security risk and compliance processes and controls. It measures, monitors, communicates, and reports cybersecurity risks, security metrics, mitigation plans, and strategic and tactical plan progress. The analyst assesses and reports policy, procedure, and standards exceptions; engages staff and vendors to develop mitigation plans; and designs, reviews, matures, and manages internal IT controls that protect the confidentiality, integrity, and availability of critical information assets. The analyst maintains control evidence and represents it to auditors and regulators, serving as the primary liaison for internal and external audits and assessments. The role also works with department leadership on security strategy, goals, and objectives; supports strategic initiatives through analysis, design, artifacts, and technical-requirements validation; and provides functional expertise, guidance, and knowledge-building. Additional expectations include overseeing enhancement or project work, demonstrating business and technical acumen, delivering presentations, managing and communicating change, and performing other related duties as requested.

Requirements

Bachelor's degree required; equivalent years of relevant work experience may be accepted in lieu of required education.
Ten years of IT, IT Risk, or Security experience required.
Ability to prioritize and execute tasks effectively, independently and in a collaborative team environment.
Strong interpersonal, written and verbal communication, listening, critical-thinking, presentation, and facilitation skills.
Strong organizational skills to prioritize and manage workload.
Ability to establish effective working relationships with stakeholders at all levels.
Flexibility during organizational or business changes.
Ability to manage multiple projects with a sense of urgency.
Effective problem-solving skills and attention to detail.
Ability to disseminate information effectively to appropriate audiences verbally and in writing.
Ability to foster appropriate participation within teams and gather input to support decision-making.
Working technical knowledge or experience in IT Audit/Compliance/Risk, Security/Management, and Project/Program Management.

Nice To Haves

Master's degree preferred.
Five years of Security Risk or Program Management experience preferred.
Information security certifications such as CISSP, CRISC, SSCP, CISA, or CISM preferred.
Project Management Professional (PMP) certification preferred.

Responsibilities

Collaborate with stakeholders and customers to execute information security risk and compliance processes and controls.
Measure, monitor, communicate, and report cybersecurity risk, security metrics, mitigation plans, and the status of strategic and tactical plans.
Assess and report exceptions to information risk management policies, procedures, and standards to management.
Engage staff and vendors to develop mitigation plans for identified risks.
Design, review, mature, and manage internal IT controls that protect the confidentiality, integrity, and availability of critical information assets.
Maintain robust evidence of controls and present control records to internal and external auditors and regulators.
Serve as the primary point of contact and liaison for internal and external auditors and regulators during IT audits and assessments.
Work with department leadership to establish security strategy, goals, and objectives.
Facilitate analysis, design, artifacts, and technical requirements validation for strategic initiatives.
Act as a functional-domain expert and build employee knowledge and skills in areas of expertise.
Oversee and provide guidance on enhancement or project work.
Deliver engaging, informative, and well-organized presentations.
Execute and communicate change management effectively.
Perform other job-related duties as requested.