Senior Analyst, Governance Risk Compliance

DriveTime • Tempe, AZ

4d • Remote

About The Position

The Senior Analyst, Governance Risk Compliance serves as a senior-level technical risk leader within the Information Security Governance, Risk & Compliance (GRC) function. The role independently leads complex cybersecurity risk assessments across applications, infrastructure, cloud environments, identity platforms, data protection controls, and business processes. It helps strengthen and mature the organization’s risk management program through standardized assessment methodologies, risk treatment guidance, compliance and audit support, third-party assessments, and mentorship of other GRC professionals. The position combines technical cybersecurity knowledge, business risk acumen, and the ability to influence stakeholders across the organization.

This is a work-from-home position for employees in an approved city and state. The employee is expected to have a quiet, conducive home-office workspace and reliable, secure internet. Hiring is contingent on successful completion of background and drug screening. DriveTime is a drug-free, tobacco-free workplace and an Equal Opportunity Employer.

Requirements

• At least 7 years of relevant experience in Information Security, cybersecurity risk management, security engineering, security architecture, IT risk, IT audit, or a related discipline.
• At least 3 years of experience independently leading technical cybersecurity risk assessments.
• Demonstrated experience assessing applications, infrastructure, cloud environments, identity solutions, or other technical systems and evaluating associated security controls and threat scenarios.
• Experience developing risk statements, conducting control assessments, and delivering actionable risk treatment recommendations.
• Experience establishing, enhancing, or maturing cybersecurity risk assessment methodologies, documentation practices, scoring models, governance routines, or reporting frameworks.
• Strong knowledge of the NIST Cybersecurity Framework (CSF).
• Familiarity with NIST SP 800-30, NIST SP 800-53, or similar cybersecurity risk assessment and control frameworks.
• Bachelor’s degree in Cybersecurity, Information Technology, Information Systems, Computer Science, Risk Management, or a related field.
• Strong technical understanding of cybersecurity threats, vulnerabilities, attack vectors, and security controls across identity, network, endpoint, application, cloud, and data security domains.
• Ability to independently assess technical risks, identify control gaps, evaluate compensating controls, and determine practical risk treatment strategies.
• Strong analytical and critical thinking skills, including the ability to challenge assumptions, prioritize risks, and make sound risk-based recommendations.
• Exceptional written and verbal communication skills and the ability to translate complex technical risks into business-focused recommendations.
• Strong organizational and project management skills, including the ability to manage multiple concurrent initiatives and assessments.
• Ability to influence and collaborate effectively with technical and non-technical stakeholders without direct authority.
• Demonstrated ability to improve processes, methodologies, reporting capabilities, and governance practices.
• Strong attention to detail and commitment to high-quality risk assessments, documentation, and reporting.
• Ability to mentor and develop less experienced team members while fostering collaboration and continuous improvement.
• Comfort navigating ambiguity and driving results in a dynamic, evolving cybersecurity environment.

Nice To Haves

• CISSP, CRISC, CISA, or comparable cybersecurity, risk, or audit certifications.
• Experience within regulated industries, particularly financial services.
• Knowledge of GLBA, FTC Safeguards Rule, PCI DSS, privacy regulations, or related compliance requirements.
• Experience supporting third-party risk management programs.
• Experience with security awareness and training initiatives.
• Experience supporting internal or external audits.
• Familiarity with GRC platforms and risk management technologies.
• Experience leading cross-functional projects and influencing stakeholders at multiple organizational levels.

Responsibilities

• Lead complex Information Security risk assessments across applications, infrastructure, cloud, identity, data, and business processes, including threat identification, control evaluation, likelihood and impact analysis, risk scoring, treatment planning, documentation, tracking, and reporting.
• Develop, standardize, and enhance cybersecurity risk assessment methodologies, control evaluation frameworks, documentation standards, risk scoring models, and management reporting processes.
• Lead assigned GRC services and initiatives, including compliance monitoring, policy governance, audit support, third-party security assessments, due diligence activities, and related risk management processes.
• Provide technical risk management leadership, subject-matter expertise, quality reviews, process improvement recommendations, and mentorship to other analysts.
• Assess technical security findings, vulnerabilities, and compensating controls to develop clear risk statements and actionable treatment recommendations.
• Evaluate business impacts, identify material cybersecurity risks, and prepare risk acceptance or remediation recommendations for management decisions.
• Conduct control assessments against applicable policies, standards, regulatory obligations, contractual requirements, and industry frameworks; track remediation and recurring issues.
• Lead third-party cybersecurity assessments and partner with Vendor Management, Legal, Compliance, Technology, and business stakeholders to identify and address security risks.
• Coordinate and develop responses to cybersecurity due diligence questionnaires, customer security reviews, external assessments, insurance inquiries, and related requests.
• Support Information Security policy governance by drafting, reviewing, updating, and maintaining policies, standards, and related documentation.
• Own or support Information Security awareness and education initiatives, including communications, training content, campaign development, program metrics, and continuous improvement.
• Own assigned GRC services and risk management processes by establishing procedures, metrics, governance routines, and accountability frameworks.
• Mentor GRC Analysts and promote consistent, high-quality risk assessment and reporting practices throughout the organization.
• Perform other duties as assigned.

Benefits

• Medical, dental, and vision insurance, with the company covering a sizable amount of insurance premiums.
• Company-paid life insurance.
• Short- and long-term disability coverage.
• 401(k).
• Tuition reimbursement.
• Wellness program with self-guided coaching and journeys, cash incentives, and discounts on medical premiums.
• Paid time off, including wellness days, holidays, and personal time for full-time roles.
• Professional growth opportunities and employee promotions.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior