Sr. Information Security Governance, Risk and Compliance Analyst

BlueCross BlueShield of Tennessee•Chattanooga, TN

1d•Remote

About The Position

The Senior Information Security Governance, Risk and Compliance Analyst is a technical subject matter expert on the Governance, Risk & Compliance (GRC) team, with a focus on application security risk management. The role leads governance and oversight of the SAST/DAST application security scanning program, assesses security vulnerabilities and scan findings, and partners with application teams, incident management teams, and business stakeholders to prioritize and remediate risk. It focuses on improving the value of SAST/DAST tools, vulnerability management, risk visibility, and the translation of technical findings into actionable business risk insights. The role also supports a high-visibility Data Governance initiative, partnering with business leaders, data owners, security, privacy, compliance, and technology teams to establish governance standards, assess risk, monitor compliance, and strengthen data stewardship. It helps shape enterprise-wide data governance decisions and advance the Data Governance program by translating governance and regulatory requirements into practical processes, driving accountability for data quality and policy adherence, and balancing regulatory expectations with business objectives. The position supports SOC 2 audits, NIST frameworks and System Security Plan (SSP) development, third-party risk management, security governance, and communication of security risks to technical and non-technical audiences. It requires participation in an on-call rotation for two weeks every 22 weeks and availability during Eastern Time business hours. It is a remote, work-from-home position; the final interview round is onsite at the Chattanooga, Tennessee office. Sponsorship is not available.

Requirements

Bachelor’s degree in a relevant field, or an equivalent of four years of experience.
Five years of professional experience in Information Security or related IT roles with security-related responsibilities, including at least two years focused on GRC functions.
Hands-on experience with SAST/DAST platforms and expertise in application security testing, vulnerability management, and risk assessment.
Proven ability to drive remediation efforts.
Ability to assess and document organizational risks, identify impacts, and recommend mitigation strategies.
Ability to interpret and apply regulatory requirements and industry frameworks, including NIST, SOC 2, and HIPAA, to organizational controls.
Ability to analyze security, compliance, and risk metrics to identify trends and drive continuous improvement.
Ability to communicate complex risk and compliance concepts clearly to technical and non-technical stakeholders.
Ability to collaborate effectively across cross-functional teams and integrate GRC practices into business processes.
Exceptional time management skills.
Excellent oral and written communication skills.
Strong interpersonal and relationship-building skills with internal and external stakeholders, promoting diversity of people, perspectives, and ideas.
Ability to work with all levels of staff and management.
Ability to work Eastern Time business hours and participate in an on-call rotation for two weeks every 22 weeks.

Nice To Haves

Experience using AI-enabled tools to automate and enhance GRC processes, improving efficiency, consistency, and scalability.
One or more of the following certifications: CISSP, CRISC, CISA, or CISM.
Experience supporting SOC 2 audits, NIST frameworks and SSP development, third-party risk management, governance activities, and communication of complex security risks to technical and non-technical audiences.

Responsibilities

Lead SOC 2 audit support, coordinating evidence collection, control validation, and auditor engagement.
Maintain control documentation, mappings, and narratives, and partner with control owners to ensure control effectiveness and alignment with Trust Services Criteria and NIST frameworks.
Oversee audit findings and remediation activities, ensuring issues are closed in a timely manner.
Create and update NIST System Security Plans (SSPs), including control implementations, inheritance, and system boundaries.
Design and manage security awareness training initiatives, including phishing simulations and targeted campaigns.
Manage the lifecycle of security policies, standards, and procedures to support compliance and audit readiness.
Conduct enterprise and third-party risk assessments, maintain risk registers, perform vendor risk assessments, and monitor remediation.
Oversee vulnerability management, track remediation against SLAs, and collaborate with teams to mitigate risks.
Respond to customer RFPs and security questionnaires, ensuring security representations are accurate, compliant, and consistent.
Lead by example and support initiatives across GRC areas while fostering collaboration and shared accountability.
Lead governance and oversight of the SAST/DAST application security scanning program and assess application and infrastructure scan findings.
Partner with application teams, incident management teams, and business stakeholders to prioritize and remediate security risks.
Support the Data Governance initiative by helping establish governance standards, assess risk, monitor compliance, and strengthen data stewardship practices.
Communicate technical findings and complex governance, risk, and compliance requirements as actionable information for business and technical stakeholders.