Senior Security Analyst, Governance, Risk, and Compliance

Caliber Collision•Lewisville, TX

20h

About The Position

The Senior Security Analyst, Governance, Risk, and Compliance will lead governance efforts by developing, implementing, and enforcing IT and platform development control standards. The role identifies and assesses risks, creates mitigation strategies, and promotes risk accountability across the organization. It also involves hands-on project management for control-related projects and initiatives, with a proactive focus on governance and risk. The ideal candidate is team-oriented, communicates technical issues effectively, and enjoys solving challenges in a fast-paced environment. The position leads and supports technology compliance activities across on-premises and key cloud environments, including Azure, GCP, and Snowflake. It oversees compliance program activities, risk and control assessments, third-party compliance, monitoring and remediation, reporting, policy administration, and continuous improvement through automation. The role works with executives, business partners, IT teams, auditors, clients, vendors, and professional peers to maintain effective controls and align procedures with evolving regulations and risks.

Requirements

Bachelor’s degree in computer science, Information Security, or a related field.
Professional certification such as CISSP, CISM, CISA, or equivalent.
At least 5 years of experience in cybersecurity, IT risk, audit, and/or IT compliance.
Strong knowledge of IT auditing and risk management techniques and IT general control processes, including change management, systems development life cycle, information security, and IT operations.
A successful track record of positively influencing stakeholders.
Strong communication and presentation skills.
Experience establishing strong working relationships with business partners.
Demonstrated ability to work across organizational boundaries and influence others.
Ability to define and manage internal projects and milestones, with demonstrated leadership skills.
Demonstrated ability to develop and present risk information to all levels of an organization.
Experience automating controls and working with data and analytics.
Strong understanding of IT risk management requirements and frameworks, including SOX, COBIT, and NIST CSF.
Must be eligible to work in the U.S. with no restrictions.

Responsibilities

Develop, maintain, and update security policies, procedures, and guidelines in alignment with standards such as ISO 27001 and NIST.
Assist in defining security governance frameworks and ensure organizational adherence.
Conduct risk assessments of systems, processes, and third-party vendors; determine risk impact and support meaningful control design with leadership.
Evaluate third-party security controls and manage vendor compliance with organizational security requirements.
Lead the design, development, and execution of the compliance program, ensuring technology and business processes meet compliance requirements.
Manage compliance program activities, including gap assessments, risk management and mitigation, monitoring and auditing, policy administration, violation handling, and corrective actions.
Monitor business and technology activities and risks for compliance with applicable cybersecurity rules and regulations.
Communicate complex issues clearly to executive management and team members, and prepare compliance status reports for management, clients, and auditors.
Analyze risks associated with platform transaction processing and their impact on compliance controls.
Track relevant laws and regulations and update operating manuals, policies, and procedures when cybersecurity regulations change.
Grow Technology Compliance capabilities across on-premises and key cloud environments, including Azure, GCP, and Snowflake.
Develop and implement monitoring activities for high-risk, externally exposed applications.
Consult with stakeholders on current, modified, and future governance, risk, and controls activities, including those related to Sarbanes-Oxley and Internal Controller.
Oversee daily operations of the Technology Compliance Dashboard, identify control gaps, monitor remediation to completion, and troubleshoot dashboard technology issues.
Document business requirements for new monitoring controls and work with IT teams to convert requirements into controls.
Stay informed about changes in IT and cybersecurity environments to keep compliance procedures aligned with current processes and risks.
Review current processes and recommend best practices for improvement through automation.
Promote cybersecurity risk awareness by providing expertise on control identification, implementation, monitoring, and best practices.
Maintain and develop professional contacts among cybersecurity and IT risk management peers, consultants, and vendors.
Develop knowledge of evolving best practices through peer benchmarking, industry events and associations, and educational opportunities.
Define and manage internal projects and milestones and influence stakeholders across organizational boundaries.