Sr GRC Analyst

TAG - The Aspen Group•Chicago, IL

About The Position

The Senior Governance, Risk, and Compliance (GRC) Security Analyst role at The Aspen Group (TAG) is a critical position responsible for supporting the business's security direction and enhancing its overall security posture. This role requires a blend of understanding legacy systems and new technologies to support the security strategy within existing and new information system capabilities. The analyst will be involved in the planning and design of policies and their maintenance. The position oversees the business's security requirements and obligations mandated by various standards and regulations, including SOX, CCPA, HIPAA, and PCI DSS. The Senior GRC Security Analyst will work with security leadership to assess and validate the security program's assurance, act as a primary contact for auditors, and monitor the resolution of compliance and security issues. The role emphasizes strong risk management and corporate resiliency, not solely compliance.

Requirements

Bachelor’s degree in computer science, information assurance, MIS or related field, or equivalent industry experience.
At least 5 years experience in cybersecurity as a practitioner.
At least 5 years exposure to various security frameworks.
Strong business acumen and security technology skills for well-rounded proficiency, as well as proven ability to align with security practices and compliance responsibilities.
Experience and understanding of various regulatory requirements and laws, including but not limited to PCI, SOX, HIPAA, CCPA and GLBA.
Exceptional written and verbal communication skills, and proven ability to translate security and risk to all levels of the business.
Capacity to understand legacy and progressive technology and security controls along with respective risk.
Working knowledge of technologies such as artificial intelligence, cloud computing, DevOps and application security is required.
Up-to-date understanding of a wide-range of incident response, system configuration, vulnerability management and hardening guidelines.
Track record of acting with integrity, taking pride in work, seeking to excel, being curious and adaptable, and communicating effectively.
Demonstrated problem-solving capabilities, and ability to manage complex local and international security requirements.
Self-motivated, directed and well-organized, with the vision to position controls in anticipation of threats.
Successful track record of managing external entities’ contracts and relationships, and mitigating risks to business development opportunities.
Familiarity with state, federal and international privacy laws.
Highly trustworthy; leads by example.

Nice To Haves

Certifications strongly preferred: CISA, CRISC, CISM, CISSP, ISO 27701 Lead Implementer
Additional experience in one or more of the following: ISO 27001/2, ITIL or NIST.
Prior experience with leading GRC systems.

Responsibilities

Conduct enterprise-wide, ongoing risk analysis in tandem with compliance and security.
Maintain oversight in GRC-related platforms.
Identify strengths and weaknesses in the security program as they relate to privacy, security, business resiliency and compliance frameworks.
Document, formulate and enforce areas of security improvement that balance risk with business operations and do not diminish efficiencies or innovation.
Maintain strong oversight of third parties, vendors and business partners to safeguard against undue risk presented by external entities.
Escalate to security management and business unit leads when points of weakness are discovered.
Analyze findings, and document, recommend and report program gaps to security leadership.
Monitor current and proposed security changes impacting regulatory, privacy and security industry best practice guidance.
Apply GRC expertise across key lines of business, including products, practices and procedures.
Ensure security and technology teams maintain up-to-date configuration documentation for systems and processes.
Maintain rigorous oversight of security systems and security configuration administration to reduce risk to enterprise systems and accounts.
Act as a key participant in incident response to track occurrence and resolution, with strict documentation and reporting.
Work in tandem with security, audit and risk management leadership to perform ongoing security program assessments and create annual strategic technology and budgetary directives.
Attend and fully engage in change and project management meetings.
Liaise with auditors, both internal and external, to maintain and implement controls for compliance and privacy laws.
Act as a point of contact for disaster recovery and business continuity as it relates to security frameworks, compliance and privacy laws.
Mentoring and coaching of junior GRC analysts.
Perform other duties as assigned.