Sr Analyst GRC Cybersecurity

NRECA•Arlington, VA

1d•$150,000 - $185,000•Hybrid

About The Position

NRECA is a national trade association serving more than 900 consumer-owned electric cooperatives. The Senior Analyst, GRC Cybersecurity leads key cybersecurity Governance, Risk, and Compliance functions, including risk identification, assessment, prioritization, lifecycle governance, compliance, and issue management. The role analyzes findings to strengthen controls and governance processes and advises IT and business stakeholders on risk mitigation strategies. The position is part of NRECA’s IT community and follows its principles of Simplicity, Security, Continuity, Transparency, and Flexibility. It is eligible for a hybrid schedule, with the option to work from home up to two days per week.

Requirements

Bachelor’s degree in Computer Science, Management Information Systems, Information Security, or a related field.
At least 7 years of experience in IT and information security risk management, compliance, audit, and governance.
At least 7 years of experience leading and conducting information security risk assessments, control audits, and third-party security risk assessments.
Strong technical knowledge of IT and information security technologies, including AWS, Azure, and M365.
Experience with information security frameworks, standards, and best practices, including NIST CSF, NIST RMF, NIST 800-30, NIST 800-53, NIST 800-171, HIPAA, SOC 2, CIS, ISO 27001/27002, and COBIT.
Experience with GRC tools, report and dashboard development, and compliance automation.

Nice To Haves

Technical knowledge related to hardening operating systems, applications, and networks.
Experience reviewing system or network designs for risk and compliance across multiple enclaves or networks, including environments with different data protection or classification requirements.
Experience conducting third-party security assessments, reviewing contracts for security requirements, and incorporating risk management practices into existing processes.
Experience leading implementation of technical security controls across all phases of the SDLC, aligned with security architecture standards and compliance requirements.
Preferred certifications: CISSP, CRISC, CISA, or CISM.

Responsibilities

Lead activities to identify, assess, and prioritize cybersecurity risks, ensuring alignment with legal, regulatory, contractual, policy, and standard requirements.
Partner with risk and control owners to develop, implement, and maintain risk registers and metrics; govern and report on risks and mitigations throughout their lifecycle; and maintain risk management policies, standards, and the assessment plan.
Manage compliance and issue management activities, coordinate with regulators and auditors to track and remediate issues, test control design and effectiveness, partner with owners on remediation, and report findings and status.
Analyze findings to identify vulnerabilities and opportunities to strengthen controls, governance, and mitigation; advise leaders on improvements and ensure risks are prioritized and escalated appropriately.
Perform cybersecurity risk governance, ensure activities follow the governance framework, and report on conformance.
Facilitate monthly security risk meetings to report activities, metrics, risks, and improvement opportunities.
Optimize the risk governance framework based on best practices and guide IT and business stakeholders in implementing governance requirements.
Lead development of third-party risk management policies and standards, advise on the annual assessment plan, and work with stakeholders on third-party assessments and risk management.
Define risk and control requirements for systems, data, and technology across cloud, on-premises, and third-party environments; assess system designs for risks and cybersecurity noncompliance.
Maintain and develop expertise in GRC trends, technologies, and evolving methods to support organizational alignment with current practices.