Lead IT GRC Analyst (Policy Management)

NBCUniversal•New York, NY

1d•Remote

About The Position

The Lead IT GRC Analyst leads the operational execution, integration, and continuous improvement of NBCUniversal’s Cyber Governance & Controls function. The role turns a broad portfolio of policies, standards, configuration baselines, risk acceptance memoranda, control libraries, and governance advisory work into a coordinated, measurable enterprise service. It connects governance strategy to day-to-day operations and works across Cybersecurity, Operations & Technology, Legal, Privacy, Audit, Procurement, and business stakeholders to establish ownership, decision rights, evidence expectations, review cadences, exception paths, and sustainable control outcomes. The position enables eight connected service lines: policy and standards lifecycle management; security baselines and control governance; vendor security management; continuous third-party monitoring; GRC tooling and workflow automation; data protection governance; program governance advisory; and regulatory, audit, and standards interpretation. It is accountable for the operating health, maturity, adoption, traceability, and effectiveness of Governance, while partnering with program management teams and retaining ownership of Governance-specific operating models, service practices, metrics, decision rights, and enablement. This is a fully remote position, expected to be performed from a non-NBCUniversal worksite, most commonly the employee’s residence. The role is eligible for company-sponsored benefits. The salary range is $110,000–$140,000 and the position is bonus eligible.

Requirements

At least 5 years of experience in governance, risk management, compliance, cybersecurity operations, business operations, service operations, or a related discipline.
Bachelor’s degree or equivalent relevant professional experience.
Experience establishing and managing operating processes, governance frameworks, service management practices, or control environments.
Experience developing executive reporting, scorecards, dashboards, and performance measures.
Demonstrated ability to coordinate work across multiple stakeholders and functions in a complex organization.
Exceptional written and verbal communication skills, including the ability to translate complex governance and cybersecurity topics into clear, audience-appropriate messages.
Strong writing, verbal communication, facilitation, analytical, and organizational skills.

Nice To Haves

Experience supporting Governance, Risk and Compliance, cybersecurity, audit, third-party risk, or enterprise risk functions.
Knowledge of governance frameworks, controls management, policy management, and enterprise operating models.
Experience with ServiceNow IRM, LogicGate, Archer, Jira, or comparable governance and workflow platforms.
Familiarity with NIST, ISO 27001, PCI DSS, or CIS frameworks and standards.
Demonstrated success driving operational excellence, process improvement, stakeholder adoption, and organizational change.
Ability to translate complex governance requirements into practical, sustainable business processes.
Growth mindset, intellectual curiosity, and willingness to learn, adapt, and continuously improve in a rapidly evolving environment.
Understanding of AI governance principles, emerging AI risks, responsible AI practices, and integration of AI requirements into enterprise governance and control frameworks.
Exceptional attention to detail and commitment to accurate, consistent, complete, high-quality deliverables.
Self-directed and collaborative, with the ability to manage competing priorities in a highly matrixed environment.
Experience with cybersecurity governance and controls operating models.
Experience with policy, standard, configuration baseline, procedure, and guidance lifecycle management.
Experience with Cybersecurity Risk Acceptance Memoranda, policy exceptions, corrective actions, and retirement governance.
Experience with service catalogs, service ownership, intake, workflow, portfolio reporting, and operating health.
Experience with control libraries, framework mapping, evidence expectations, requirement-centric governance, and policy-as-code readiness.
Experience with third-party and vendor security governance, continuous monitoring, and incident-response integration.
Experience with data protection, AI, identity, attack surface, resilience, and infrastructure governance.
Experience with GRC platforms, records of authority, workflow automation, dashboarding, and cross-system integration.
Experience with regulatory and audit interpretation, executive communications, and leadership decision support.
Experience with organizational change, stakeholder socialization, self-service enablement, and sustainable adoption.

Responsibilities

Develop, implement, and continuously improve Governance operating procedures, playbooks, lifecycle schedules, decision records, and recurring operating rhythms.
Coordinate policy forums, standards reviews, governance working sessions, steering decisions, escalations, action-item closure, and quarterly operating reviews.
Coordinate the Global Cybersecurity Governance Steering Committee, including agenda planning, materials, stakeholder alignment, decision tracking, follow-through, and reporting.
Chair the Global Cybersecurity Governance Working Group, facilitate cross-functional discussions, drive alignment, escalate decisions, and ensure actions are assigned, documented, and completed.
Define and maintain roles, decision rights, RACIs, reviewers, approvers, accountable service owners, evidence expectations, and exception paths across Governance services.
Establish a consistent definition of done for governance outcomes, including ownership, requirements, processes, automation, monitoring, metrics, exceptions, and recurring review.
Distinguish administrative, technical, and operational governance so approved requirements are implemented, monitored, evidenced, and sustained.
Operate the end-to-end lifecycle for cyber policies, standards, configuration baselines, procedures, and guidance, including intake, drafting, review, approval, publication, communication, maintenance, and retirement.
Maintain the Cyber Policy Library, document hierarchy, review calendar, approval evidence, version history, control mappings, glossary, and publication quality controls.
Coordinate development and renewal of Cybersecurity Risk Acceptance Memoranda, including current-state data, residual-risk statements, accountable owners, corrective-action plans, milestones, approvals, audit dependencies, reporting, and retirement criteria.
Help transition recurring risk acceptances toward targeted, risk-based exception and monitoring processes with sustainable ownership and evidence.
Map policies, standards, baselines, and controls to authoritative frameworks and identify opportunities to automate workflows, document reviews, approvals, and evidence collection.
Maintain the Cyber Governance & Controls service catalog, including service definitions, owners, RACIs, inputs, outputs, dependencies, intake paths, service levels, and records of authority.
Coordinate operational visibility across Governance service lines and administer common intake, triage, prioritization, status, decision, escalation, evidence, and closure practices while preserving service-owner accountability.
Measure demand, throughput, aging, adoption, quality, stakeholder experience, control effectiveness, and operational health across the Governance portfolio.
Make work delivered through remediation and transformation programs visible through consistent governance tagging, ownership, reporting, and sustainment criteria.
Improve self-service through guidance, reusable patterns, decision trees, communications, training, and content structured for people and AI-enabled assistants.
Develop and maintain Governance metrics, key performance indicators, scorecards, and dashboards; produce executive updates, quarterly operating reviews, and portfolio health reporting.
Track strategic initiatives, risks, dependencies, decisions, maturity objectives, and service performance, and translate complex Governance information into business-oriented leadership insights.
Support execution of the Cyber Governance & Controls maturation strategy across stabilization, multi-year integration and automation, and continuous, intelligence-led governance.
Convert remediation and transformation initiatives into sustainable business-as-usual governance with named owners, processes, controls, metrics, evidence, exception handling, and recurring review.
Coordinate governance design for major programs, including Frontier AI, Attack Surface Management, identity and service-account governance, secure management-plane initiatives, high-risk travel, data protection, and third-party risk.
Advance GRC modernization by defining authoritative systems of record and practical integrations across ServiceNow IRM, LogicGate RiskCloud, Jira, risk hubs, policy repositories, dashboards, and evidence sources.
Facilitate maturity assessments, current-state inventories, gap analysis, target operating models, governance gates, leadership decisions, roadmap milestones, and continuous-improvement plans.
Build productive partnerships across Cybersecurity, Operations & Technology, Legal, Privacy, Audit, Procurement, and business stakeholders.
Facilitate stakeholder alignment, decision-making, communications, and socialization for Governance initiatives, and support organizational change and adoption.
Act as a central coordination point for Governance operating information without replacing accountable service owners or enterprise program managers.