Sr Analyst GRC Cybersecurity

NRECA•Arlington, VA

1d•Hybrid

About The Position

NRECA is a national trade association providing advocacy, financial services, and business support to more than 900 consumer-owned electric cooperatives. Its IT organization emphasizes simplicity, security, continuity, transparency, flexibility, collaboration, and innovation. The Sr Analyst GRC Cybersecurity leads key cybersecurity governance, risk, and compliance functions, including identifying, assessing, prioritizing, and governing cybersecurity risks throughout their lifecycle, as well as managing compliance and issues. The role analyzes findings to strengthen controls and governance, and advises IT and business stakeholders on mitigation strategies and risk prioritization. The position is eligible for NRECA’s hybrid schedule, allowing work from home up to two days per week. Compensation is $150,000–$185,000 annually, with final compensation determined by qualifications, experience, and internal equity.

Requirements

Bachelor’s degree in Computer Science, Management Information Systems, Information Security, or a related field.
At least 7 years of experience in IT and information security risk management, compliance, audit, and governance.
At least 7 years of experience leading and conducting information security risk assessments, control audits, and third-party security risk assessments.
Strong technical knowledge of IT and information security technologies, including AWS, Azure, and M365.
Experience with information security frameworks, standards, and best practices, including NIST CSF, NIST RMF, NIST 800-30, NIST 800-53, NIST 800-171, HIPAA, SOC 2, CIS, ISO 27001/27002, and COBIT.
Experience with GRC tools, report and dashboard development, and compliance automation.

Nice To Haves

Technical knowledge of security hardening for operating systems, applications, and networks.
Experience reviewing system or network designs for risk and compliance across multiple enclaves or networks, including environments with different data protection or classification requirements.
Experience conducting third-party security assessments, reviewing contracts for security requirements, and incorporating risk management practices into existing processes.
Experience leading implementation of technical security controls across all phases of the SDLC, aligned with security architecture standards and compliance requirements.
Preferred certifications: CISSP, CRISC, CISA, or CISM.

Responsibilities

Advise IT and business units by leading cybersecurity risk identification, assessment, and prioritization in alignment with legal, regulatory, contractual, policy, and standards requirements.
Partner with risk and control owners to develop, implement, and maintain risk registers and metrics; govern and report on risks and mitigations throughout their lifecycle; and maintain risk management policies, standards, and the assessment plan.
Manage compliance and issue management activities, coordinating with regulators and auditors to track and remediate issues.
Test control design and effectiveness, work with owners on remediation, and report findings and status.
Analyze findings to identify vulnerabilities and opportunities to strengthen controls, governance, and mitigation.
Advise leaders on improvements and ensure appropriate risk prioritization and escalation.
Perform cybersecurity risk governance, ensure activities follow the governance framework, and report on conformance.
Facilitate monthly security risk meetings to report activities, metrics, risks, and improvement opportunities.
Optimize the risk governance framework based on best practices and guide IT and business stakeholders in implementing governance requirements.
Lead development of third-party risk management policies and standards, advise on the annual assessment plan, and work with stakeholders on third-party assessments and risk management.
Define risk and control requirements for systems, data, and technology across cloud, on-premises, and third-party environments; assess system designs for risk and cybersecurity noncompliance.
Maintain and develop expertise in GRC trends, technologies, and evolving methods to support organizational alignment with current practices.