Cybersecurity GRC & Controls Assurance Analyst (Automation)

Blue-Cross-Blue-Shield-of-Nebrask; Omaha (NE); Hybrid; USD 95,000 - 120,000; Full time

Job summary

Blue Cross and Blue Shield of Nebraska is seeking a cyber/GRC analyst to strengthen controls across a modern technology environment. You will perform risk-based assessments, verify controls, and support audits while collaborating with cybersecurity, risk, and business teams to drive remediation.

The role requires 3–5 years in cybersecurity assurance or related fields, strong knowledge of NIST/CIS/HITRUST/ISO27001, and the ability to translate findings into practical remediation actions.

Qualifications

• Bachelor's degree or equivalent experience in cybersecurity.
• 3–5 years of cybersecurity assurance, security operations, or related experience.
• Experience with cybersecurity frameworks (NIST, CIS Controls, HITRUST, HIPAA, or ISO 27001).
• Ability to interpret technical evidence and translate findings into practical risk and remediation recommendations.

Responsibilities

• Validate security posture using automated testing and control assessments across cloud, identity, endpoint, network and data protection systems.
• Support audits and regulatory reviews, and participate in validation activities such as configuration testing and vulnerability validation.
• Develop and maintain cyber risk metrics, dashboards, and executive-ready reporting for governance.
• Collaborate with cybersecurity, technology, risk, audit, and business teams to prioritize remediation efforts.

Skills

GRC

Penetration testing

Purple team testing

Attack-path analysis

MITRE ATT&CK

Communication to stakeholders

Education

Bachelor's degree in Cybersecurity or related field

Tools

GRC platforms

Job description

Blue Cross and Blue Shield of Nebraska is seeking a cyber/GRC analyst to strengthen controls across a modern technology environment. You will perform risk-based assessments, verify controls, and support audits while collaborating with cybersecurity, risk, and business teams to drive remediation.

The role requires 3–5 years in cybersecurity assurance or related fields, strong knowledge of NIST/CIS/HITRUST/ISO27001, and the ability to translate findings into practical remediation actions.