Security Analyst, Governance Risk Compliance

DriveTime • Tempe, AZ

23h • Remote

About The Position

DriveTime Family of Brands is hiring a seasoned cybersecurity professional to support governance, risk, and compliance (GRC) activities and partner with business teams. The role helps the organization identify, assess, manage, and communicate cybersecurity risk while supporting compliance obligations, audits, policy governance, third-party security reviews, and security awareness initiatives. It translates technical security findings into meaningful business risk and helps develop practical solutions to strengthen the organization’s security posture.

The position leads information security risk assessments and cyber risk management activities; performs compliance monitoring and control assessments; and leads assigned GRC services, including policy governance, audit support, third-party security assessments, due diligence, and security awareness. It also provides subject matter expertise, risk guidance, reporting, process-improvement recommendations, and mentorship within the GRC function.

The role is work from home in an approved city and state. Employees are expected to maintain a quiet, conducive home workspace and reliable, secure internet. Hiring is contingent on successful completion of background and drug screening. DriveTime is a drug-free, tobacco-free workplace and an Equal Opportunity Employer.

Requirements

• Strong understanding of cybersecurity risk management, governance principles, security controls, and compliance assessment methodologies.
• Ability to translate technical security findings into clear business risks and actionable recommendations.
• Strong analytical, critical-thinking, and problem-solving skills.
• Excellent written and verbal communication abilities and confidence engaging stakeholders at all levels.
• Ability to facilitate discussions and present complex information to technical and non-technical audiences.
• Strong organizational skills and ability to prioritize multiple projects and deadlines.
• Collaborative mindset and ability to build effective partnerships across Information Security, Technology, Legal, Compliance, Internal Audit, Vendor Management, and business teams.
• Self-starter mentality and ability to take ownership of programs, services, and process improvements.
• Interest in mentoring and developing others while fostering high-quality and consistent work practices.
• Strong attention to detail and commitment to continuous learning in cybersecurity and risk.
• 4+ years of experience in Information Security GRC, cybersecurity risk management, IT compliance, IT audit, security assurance, or a related discipline.
• Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Business, Risk Management, Audit, or a related field.
• Demonstrated experience independently conducting risk assessments, evaluating controls, documenting findings, and developing remediation or risk-treatment recommendations.
• Experience supporting and improving GRC processes, methodologies, workflows, and enabling technologies.
• Familiarity with the NIST Cybersecurity Framework (CSF) and Information Security risk and control concepts.

Nice To Haves

• Experience with frameworks and requirements such as NIST 800-53, PCI DSS, SOC reporting, GLBA/FTC Safeguards Rule, or state privacy and security regulations.
• Professional certifications such as CISSP, CISA, CRISC, Security+, or similar cybersecurity, risk, or audit-related credentials.
• Experience with third-party risk management, security awareness programs, privacy initiatives, technology audits, or related cybersecurity domains.
• Experience supporting audit and compliance programs in highly regulated environments.
• Exposure to security governance, policy management, and enterprise risk reporting.

Responsibilities

• Lead Information Security risk assessments and cyber risk management activities, including risk identification, analysis, scoring, treatment planning, documentation, tracking, and reporting.
• Perform Information Security compliance monitoring and control assessments against policies, standards, frameworks, contractual obligations, and regulatory requirements.
• Lead assigned GRC services, including policy governance, audit support, third-party security assessments, due diligence activities, and security awareness programs.
• Provide subject matter expertise, risk guidance, reporting, process-improvement recommendations, and mentorship within the GRC function.
• Independently facilitate risk assessments and evaluate control effectiveness across technology and business environments.
• Develop clear risk statements and practical risk-treatment recommendations for management review and decision-making.
• Support internal and external audits by coordinating evidence collection, interpreting requests, and tracking remediation efforts.
• Conduct cybersecurity assessments of third-party vendors and collaborate with business partners to address identified risks.
• Coordinate responses to security due diligence questionnaires, insurance inquiries, and external security assessments.
• Manage the Information Security policy lifecycle, including drafting, reviewing, updating, tracking approvals, and supporting periodic reviews.
• Support and enhance security awareness and education initiatives through communications, campaigns, training content, and reporting.
• Maintain GRC processes, procedures, methodologies, and performance metrics while identifying opportunities for continuous improvement.
• Guide and mentor less-experienced analysts and promote consistent GRC practices across the organization.
• Perform other duties as assigned.

Benefits

• Medical insurance coverage, with the company covering a sizable amount of premiums.
• Dental insurance coverage.
• Vision insurance coverage.
• 401(k).
• Company-paid life insurance.
• Short- and long-term disability coverage.
• Professional growth opportunities.
• Tuition reimbursement.
• Wellness program with self-guided coaching and journeys, cash incentives, and medical premium discounts for participation.
• Competitive pay.
• Paid time off, including wellness days, holidays, and personal time for full-time roles.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior