Senior Cybersecurity GRC Analyst

REPAY•Atlanta, GA

About The Position

REPAY is seeking a proactive, detail-oriented Senior Cybersecurity GRC Analyst with expertise in governance, risk, and compliance and a strong focus on tool automation. The role strengthens and optimizes the company’s cybersecurity and GRC technology stack, with particular emphasis on GRC automation, Identity Governance and Administration (IGA), phishing program effectiveness, and Trust Center management. The position reports directly to the Manager of Cybersecurity GRC. The analyst will partner with stakeholders to align security practices with applicable frameworks and regulations, automate control evidence and GRC workflows, and provide actionable risk reporting to senior management. The role also supports customer and regulatory discussions, cybersecurity questionnaires, identity lifecycle and access governance, phishing awareness and response, integrations between security platforms, and the upkeep of the customer-facing Trust Center. The position requires collaboration across technical and business teams and may be performed by qualified candidates eligible to work in the United States, except in California. Visa sponsorship is not available.

Requirements

Bachelor’s degree in computer science, Information Systems, or a related field.
At least 3 years of experience in GRC roles, including hands-on GRC tool implementation and automation; experience in technology organizations in financial services or related industries is preferred.
Hands-on experience supporting security compliance programs and their supporting tools across on-premises and cloud environments.
Experience managing projects, including timelines, resources, and stakeholder coordination.
Hands-on experience automating GRC processes and workflows within GRC platforms, including control testing, evidence collection, and risk and compliance reporting.
Experience implementing IGA solutions, including access reviews and identity lifecycle workflows.
Experience supporting phishing prevention, simulation, and response programs.
Demonstrated ability to assess an existing security technology stack and deliver measurable improvements through optimization, integration, and automation.
Experience managing or implementing a customer-facing Trust Center for sharing security posture and compliance documentation.
Strong understanding of SOX, AICPA SOC 1 and SOC 2, PCI-DSS, NIST CSF, and NIST SP 800-53.
Proficiency with GRC tools such as Hyperproof, Archer, ServiceNow, or similar platforms, including workflow configuration and automation.
Working knowledge of APIs, scripting such as Python or PowerShell, or low-code tools for security and GRC platform integration and automation.
Strong understanding of software development practices and cloud environments.
Advanced expertise with Microsoft Excel and other office tools.
Exceptional presentation and communication skills.
Proficiency in identifying risks in technology solution architecture and design.
Ability to create and present actionable risk reports and dashboards for senior leadership.
Ability to drive cross-team collaboration and deliver impactful change.
Self-motivated, improvement-oriented, and willing to take ownership of outcomes.
Ability to work independently and create or adapt processes to organizational needs.
Pragmatic approach that accounts for business context and competing priorities.
Analytical ability to assess problems, identify root causes, and recommend effective solutions.
Ability to collaborate across Engineering, IT Operations, Security, Compliance, and other diverse teams.
Must be eligible to work in the United States; visa sponsorship is not available. This position is not eligible for hire in California.

Nice To Haves

Cybersecurity certification such as CISSP, CISM, or CISA.
Experience with GRC tools such as Hyperproof, Archer, or ServiceNow; equivalent platforms are also applicable.
Experience with IGA solutions such as SailPoint, Saviynt, Okta Identity Governance, or Microsoft Entra ID Governance.
Experience with phishing tools such as KnowBe4, Proofpoint, or Microsoft Defender for Office 365.
Experience with customer-facing Trust Centers such as SafeBase, Conveyor, or Vanta Trust Center.
Familiarity with reporting tools such as Power BI or Sisense.
Experience in technology organizations in financial services or related industries.

Responsibilities

Partner with stakeholders to design, document, and enforce security policies, standards, and controls.
Align organizational security practices with NIST CSF, NIST SP 800-53, PCI-DSS, SOC 2, and related requirements.
Automate the collection, validation, and continuous monitoring of control evidence from source systems and platforms.
Map controls across multiple frameworks so automated evidence can support NIST CSF, PCI-DSS, SOC 2, and SOX requirements.
Automate and present risk reports and dashboards for senior management.
Work with the corporate compliance team to handle cybersecurity questionnaires from clients, and improve and automate the questionnaire process.
Serve as a subject matter expert in client and regulatory discussions on GRC and risk management.
Collaborate with platform owners and stakeholders to implement controls and security best practices.
Assess the cybersecurity and GRC technology stack for gaps, redundancies, and integration opportunities, and recommend and implement enhancements.
Automate GRC platform workflows, including control testing, evidence collection, policy attestations, risk register updates, and compliance reporting.
Lead or support IGA implementation and optimization, including access certifications, role-based access, joiner/mover/leaver workflows, and segregation-of-duties controls.
Support phishing simulation and awareness campaigns, user-reported phishing triage, and effectiveness metrics for risk reporting.
Build integrations and automated data flows among GRC, IGA, ticketing, and security tools using APIs, scripting, or low-code tools.
Develop business cases, roadmaps, and success metrics for tooling improvements, and track adoption and return on investment.
Own and enhance the customer-facing Trust Center, keeping security documentation, certifications, policies, and standard questionnaire responses current and streamlining customer access requests.