Lead IT GRC Analyst (Policy Management)

NBCUniversal•New York, NY

1d•$110,000 - $140,000•Remote

About The Position

The Lead IT GRC Analyst leads the operational execution, integration, and continuous improvement of NBCUniversal’s Cyber Governance & Controls function. The role turns a broad portfolio—including policies, standards, configuration baselines, Cybersecurity Risk Acceptance Memoranda, control libraries, governance models, and advisory work—into a coordinated, measurable enterprise service. It connects governance strategy with day-to-day execution and works across Cybersecurity, Operations & Technology, Legal, Privacy, Audit, Procurement, and business stakeholders to establish ownership, decision rights, evidence, review cadences, exception paths, and sustainable control outcomes. The position enables eight connected service lines: policy and standards lifecycle management; security baselines and control governance; vendor security management; continuous third-party monitoring; GRC tooling and workflow automation; data protection governance; program governance advisory; and regulatory, audit, and standards interpretation. It is accountable for the operating health, maturity, adoption, traceability, and effectiveness of Governance. The role develops governance operating procedures and service practices; manages policy, standards, baselines, and risk acceptance lifecycles; maintains service catalogs and operating records; establishes metrics, dashboards, and executive reporting; and supports governance strategy, transformation, and stakeholder adoption. The position is fully remote and eligible for company-sponsored benefits. Salary range is $110,000–$140,000 yearly and the role is bonus eligible.

Requirements

At least 5 years of experience in governance, risk management, compliance, cybersecurity operations, business operations, service operations, or a related discipline.
Bachelor’s degree or equivalent relevant professional experience.
Experience establishing and managing operating processes, governance frameworks, service management practices, or control environments.
Experience developing executive reporting, scorecards, dashboards, and performance measures.
Demonstrated ability to coordinate work across multiple stakeholders and functions in a complex organization.
Exceptional written and verbal communication skills, including the ability to translate complex governance and cybersecurity topics into clear, audience-appropriate messages.
Strong facilitation, analytical, and organizational skills.

Nice To Haves

Experience supporting Governance, Risk and Compliance, cybersecurity, audit, third-party risk, or enterprise risk functions.
Knowledge of governance frameworks, controls management, policy management, and enterprise operating models.
Experience with ServiceNow IRM, LogicGate, Archer, Jira, or comparable governance and workflow platforms.
Familiarity with frameworks and standards such as NIST, ISO 27001, PCI DSS, or CIS.
Demonstrated success driving operational excellence, process improvement, stakeholder adoption, and organizational change.
Ability to translate complex governance requirements into practical, sustainable business processes.
Growth mindset, intellectual curiosity, and willingness to learn, adapt, and continuously improve in a rapidly evolving environment.
Understanding of AI governance principles, emerging AI risks, responsible AI practices, and integration of AI requirements into enterprise governance and control frameworks.
Exceptional attention to detail and commitment to accurate, consistent, complete, high-quality deliverables.
Self-directed and collaborative, with comfort managing competing priorities in a highly matrixed environment.
Experience with cybersecurity governance and controls operating models.
Experience with policy, standard, configuration baseline, procedure, and guidance lifecycle management.
Experience with Cybersecurity Risk Acceptance Memoranda, policy exception, corrective-action, and retirement governance.
Experience with service catalogs, service ownership, intake, workflow, portfolio reporting, and operating health.
Experience with control libraries, framework mapping, evidence expectations, requirement-centric governance, and policy-as-code readiness.
Experience with third-party and vendor security governance, continuous monitoring, and incident-response integration.
Experience with data protection, AI, identity, attack surface, resilience, and infrastructure governance.
Experience with GRC platforms, records of authority, workflow automation, dashboarding, and cross-system integration.
Experience with regulatory and audit interpretation, executive communications, and leadership decision support.
Experience with organizational change, stakeholder socialization, self-service enablement, and sustainable adoption.

Responsibilities

Develop, implement, and continuously improve Governance operating procedures, playbooks, lifecycle schedules, decision records, and recurring operating rhythms.
Coordinate policy forums, standards reviews, governance working sessions, steering decisions, escalations, action-item closure, and quarterly operating reviews.
Coordinate the Global Cybersecurity Governance Steering Committee, including agenda planning, materials, stakeholder alignment, decision tracking, follow-through, and reporting.
Chair the Global Cybersecurity Governance Working Group, facilitate cross-functional discussion, align priorities, escalate decisions, and ensure actions are assigned, documented, and completed.
Define and maintain roles, decision rights, RACIs, reviewers, approvers, accountable service owners, evidence expectations, and exception paths across Governance services.
Establish a definition of done for governance outcomes covering ownership, requirements, operational processes, automation, monitoring, metrics, exceptions, and recurring review.
Ensure governance requirements are implemented, monitored, evidenced, and sustained, rather than only approved.
Operate the end-to-end lifecycle for cyber policies, standards, configuration baselines, procedures, and guidance, including intake, drafting, review, approval, publication, communication, maintenance, and retirement.
Maintain the Cyber Policy Library, authoritative document hierarchy, review calendar, approval evidence, version history, control mappings, glossary, and publication quality controls.
Coordinate development and renewal of Cybersecurity Risk Acceptance Memoranda, including current-state data, residual-risk statements, owners, corrective-action plans, milestones, approvals, audit dependencies, reporting, and retirement criteria.
Help move broad, recurring risk acceptances toward targeted, risk-based exception and monitoring processes with sustainable ownership and evidence.
Map policies, standards, baselines, and controls to authoritative frameworks and identify opportunities to automate governance workflows, reviews, approvals, and evidence collection.
Maintain the Cyber Governance & Controls service catalog, including definitions, owners, RACIs, inputs, outputs, dependencies, intake paths, service levels, and records of authority.
Coordinate operational visibility across policy and standards, control baselines, vendor security, continuous third-party monitoring, GRC tooling, data protection, governance advisory, and audit and standards interpretation.
Develop and administer common intake, triage, prioritization, status, decision, escalation, evidence, and closure practices while preserving service-owner accountability.
Measure demand, throughput, aging, adoption, quality, stakeholder experience, control effectiveness, and operational health across the Governance portfolio.
Make work delivered through remediation and transformation programs visible through consistent governance tagging, ownership, reporting, and sustainment criteria.
Improve self-service through guidance, reusable patterns, decision trees, communications, training, and content structured for people and AI-enabled assistants.
Develop and maintain Governance metrics, key performance indicators, scorecards, and dashboards; produce executive updates, quarterly operating reviews, and portfolio health reporting.
Track strategic initiatives, risks, dependencies, decisions, maturity objectives, and service performance, and translate complex Governance information into clear business-oriented insights and leadership materials.
Support execution of the Cyber Governance & Controls maturation strategy, including stabilization, multi-year integration and automation, and continuous intelligence-led governance.
Convert remediation and transformation initiatives into sustainable business-as-usual governance with named owners, documented processes, controls, metrics, evidence, exception handling, and recurring review.
Coordinate governance design for major programs such as Frontier AI, Attack Surface Management, identity and service-account governance, secure management-plane initiatives, high-risk travel, data protection, and third-party risk.
Advance GRC modernization by defining authoritative systems of record and practical integration across ServiceNow IRM, LogicGate RiskCloud, Jira, risk hubs, policy repositories, dashboards, and evidence sources.
Facilitate maturity assessments, current-state inventories, gap analyses, target operating models, governance gates, leadership decisions, roadmap milestones, and continuous-improvement plans.
Partner with program management teams while retaining ownership of Governance-specific operating models, service practices, metrics, decision rights, and enablement.
Build partnerships across Cybersecurity, Operations & Technology, Legal, Privacy, Audit, Procurement, and business stakeholders; facilitate alignment, decision-making, communications, and socialization.
Support organizational change and adoption for new or revised Governance services and processes.
Act as a central point of coordination for Governance operating information without replacing accountable service owners or enterprise program managers.