GRC Analyst

Hayward Holdings, Inc.

Clemmons (NC)

On-site

USD 110,000 - 150,000

Full time

2 hours ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Job summary

Hayward Holdings, Inc. in Clemmons, NC seeks a Senior Cybersecurity Risk & Governance Analyst to advance IT risk, governance, and compliance across SOX, ICFR, and data security.

You will lead risk assessments, control design, and audit support while coordinating with Internal Audit, IT, and business stakeholders. The role covers GRC metrics, policy standards, access governance, third-party risk, and implementation of frameworks such as NIST CSF, NIST SP 800-53, ISO 27001, and CIS Controls.

Qualifications

Bachelor's degree in Cybersecurity, Information Systems, IT, Accounting, Risk Management, or related field.
5+ years of experience in cybersecurity GRC, IT risk, IT audit, SOX compliance, or information security.
Strong knowledge of ITGCs, ICFR, logical access, privileged access, change management, and audit evidence requirements.
Hands-on experience with Varonis or comparable data loss prevention technology.
Experience with SailPoint or comparable identity governance platforms.

Responsibilities

Perform cybersecurity risk assessments across applications, infrastructure, cloud services, and technology initiatives.
Maintain cybersecurity risk registers, remediation plans, control exceptions, and risk treatment activities.
Map security controls to NIST, ISO 27001, CIS, SOX, and applicable regulatory requirements.
Develop GRC metrics, KRIs, KPIs, and management reporting to communicate cybersecurity risk and compliance posture.
Identify opportunities to automate and mature GRC processes.
Support the design, documentation, testing, and operation of IT General Controls (ITGCs) supporting SOX and ICFR.
Execute and assess controls covering logical access, privileged access, change management, system operations, and data integrity.
Produce complete, defensible audit evidence and maintain control narratives, RCMs, and testing documentation.
Partner with Internal Audit, external auditors, control owners, and IT leadership.
Identify opportunities for control automation and improved audit efficiency.
Administer Varonis capabilities supporting sensitive-data discovery, classification, monitoring, and access governance.
Identify excessive or inappropriate access to sensitive information and remediate permissions.
Develop reports, dashboards, alerts, and audit evidence related to data security and access.
Support investigations involving sensitive-data exposure and inappropriate access.
Perform UARs and access certifications for SOX-related processes.
Validate provisioning, modification, termination, and privileged access controls.
Develop SailPoint enhancements: onboarding, entitlement aggregation, role modeling, and lifecycle processes.
Assist with RBAC modeling and entitlement structures.
Identify automation opportunities for access governance.
Coordinate IT and cybersecurity activities supporting audits.
Manage remediation of security findings and third-party risk assessments.

Skills

Cybersecurity governance

IT risk management

SOX / ICFR knowledge

Audit coordination

Policy development

Stakeholder communication

Independent work

Education

Bachelor's degree in Cybersecurity, Information Systems, IT, Accounting, Risk Management, or related field

Tools

Varonis

SailPoint

SharePoint

Microsoft 365

Job description

Hayward Holdings Inc. (NYSE "HAYW") is one of the leading manufacturers of residential swimming pool equipment in the world, with a significant presence in the commercial pool market that is continuously growing. Hayward designs, manufactures, and markets a full line of residential and commercial pool and spa equipment including pumps, filters, heating, cleaners, salt chlorinators, automation, lighting, safety, flow control and energy solutions at our company owned facilities. Headquartered in Charlotte, North Carolina, Hayward also has facilities in Tennessee, Arizona, and Rhode Island, Georgia, as well as Canada, Spain, France, Australia, and China.

Senior Cybersecurity Risk & Governance Analyst

Data Loss Prevention/Governance, Risk Management, & Data Security

Location: Clemmons, NC

Reports To: Director, Global Information Security

Job Summary

The Senior Cybersecurity Risk & Governance Analyst supports the organization’s cybersecurity governance, risk, compliance, identity governance, and data protection programs. This role serves as a subject matter expert for IT controls supporting SOX and Internal Controls over Financial Reporting (ICFR), including control assessment, audit support, risk identification, and remediation.

The Senior Analyst also supports cybersecurity risk assessments, policy and standards development, access governance, third-party risk, and alignment with frameworks including NIST CSF, NIST SP 800-53, ISO 27001, and CIS Controls.

The role provides governance and operational support for Varonis and SailPoint, partnering with Information Security, IT, Finance, Internal Audit, external auditors, application owners, and business stakeholders to identify and mitigate cybersecurity and compliance risks.

Key Responsibilities

Cybersecurity Governance & Risk Management

Perform cybersecurity risk assessments across applications, infrastructure, cloud services, and technology initiatives.
Maintain cybersecurity risk registers, remediation plans, control exceptions, and risk treatment activities.
Map security controls to NIST, ISO 27001, CIS, SOX, and applicable regulatory requirements.
Develop GRC metrics, KRIs, KPIs, and management reporting to communicate cybersecurity risk and compliance posture.
Identify opportunities to automate and mature GRC processes.

SOX Compliance & Internal Controls

Support the design, documentation, testing, and operation of IT General Controls (ITGCs) supporting SOX and ICFR.
Execute and assess controls covering logical access, privileged access, change management, system operations, and data integrity.
Assess control effectiveness, identify deficiencies, perform root-cause analysis, and coordinate remediation.
Produce complete, defensible audit evidence and maintain control narratives, Risk and Control Matrices (RCMs), and testing documentation.
Serve as a key liaison with Internal Audit, external auditors, control owners, and IT leadership.
Identify opportunities for control automation and improved audit efficiency.

Data Security & Varonis Administration

Administer Varonis capabilities supporting sensitive-data discovery, classification, monitoring, and access governance.
Identify excessive or inappropriate access to sensitive, financial, confidential, and regulated information.
Partner with data owners to remediate inappropriate permissions and strengthen least-privilege access.
Develop reports, dashboards, alerts, and audit evidence related to data security and access.
Support investigations involving sensitive-data exposure and inappropriate access.

Identity & Access Governance

Perform and oversee SOX-related User Access Reviews (UARs) and periodic access certifications.
Validate provisioning, modification, termination, privileged access, and segregation-of-duties controls.
Support enhancement of the SailPoint environment, including application onboarding, entitlement aggregation, role modeling, access certifications, and lifecycle processes.
Assist with development of Role-Based Access Control (RBAC) models, access profiles, and entitlement structures.
Identify opportunities to automate access governance and improve oversight of privileged and high-risk accounts.

Audit, Compliance & Third-Party Risk

Coordinate IT and cybersecurity activities supporting internal and external audits.
Manage cybersecurity and control findings through remediation and closure.
Support security assessments of vendors, technology providers, and cloud services.
Review SOC 1/SOC 2 reports, ISO 27001 certifications, security assessments, and other third-party assurance documentation.
Partner with Audit, Legal, Privacy, IT, and business owners to address identified third-party risks.

Leadership & Stakeholder Engagement

Independently evaluate cybersecurity and compliance risks and recommend appropriate solutions.
Serve as a trusted advisor to technical and business stakeholders on security controls, SOX, Privacy, and data protection.
Translate technical and control issues into clear business risks and recommendations.
Lead cross-functional discussions regarding control deficiencies, risk acceptance, and remediation.

Required

Qualifications & Requirements

Bachelor’s degree in Cybersecurity, Information Systems, IT, Accounting, Risk Management, or related field, or equivalent experience.
5+ years of experience in cybersecurity GRC, IT risk, IT audit, SOX compliance, or information security.
Strong knowledge of ITGCs, ICFR, logical access, privileged access, change management, and audit evidence requirements.
Hands-on experience with Varonis or comparable data loss prevention technology.
Experience with SailPoint or comparable identity governance platforms.
Working knowledge of NIST CSF, NIST SP 800-53, and ISO 27001 Controls.
Strong analytical, documentation, communication, and stakeholder-management skills.
Demonstrated ability to work independently and manage multiple initiatives and deadlines.

Preferred

CISA, CRISC, CISSP, CISM, CGEIT, or CIA certification.
8-10 years of experience within a global, publicly traded, manufacturing, or similarly complex enterprise.
Experience with Varonis, SailPoint, SharePoint, and Microsoft 365.
Experience with GRC and cybersecurity risk reporting.
Knowledge of cloud security, third-party risk, data privacy, and data governance.
Experience automating controls, continuous monitoring, or audit-evidence collection.

Core Competencies