GRC Analyst - Hybrid AZ

Best Western Hotels & Resorts; Arizona; Hybrid; USD 110,000 - 160,000; Full time

Benefits offered by this job

Medical/Dental/Vision

Vacation/Sick accruals

401K matching

Employee discounts

Tuition Reimbursement

Wellness programs

Job summary

BWH Hotels is seeking a Security Compliance professional to support governance, risk, and regulatory compliance across PCI DSS, SOX, GDPR/CCPA. The role collaborates with stakeholders and auditors to maintain control documentation, evidence collection, and remediation tracking in a fast-paced environment.

The position emphasizes hands-on control testing, remediation planning, and clear reporting across IT and business units within a hybrid work arrangement at our Global Operations Center in

Qualifications

• Ensures governance, risk and compliance activities across PCI DSS, SOX, privacy and cybersecurity.

Responsibilities

• Builds rapport with stakeholders to support governance and compliance outcomes.
• Coordinates evidence requests, controls testing, remediation tracking.
• Maintains documentation for control scoping and audit readiness.
• Works with auditors to map evidence to control requirements and timelines.
• Reviews findings and elevates blockers to management.

Skills

Governance

Risk management

Compliance

Audit readiness

Evidence coordination

Communication

Education

Bachelor's or Master's in computer science/IS

CISSP

CISA

CISM

CRISC

Tools

GRC platforms

Central logging systems

File integrity monitoring

Vulnerability management

Endpoint security

Cloud security tools

Job description

Join BWH Hotels – Where Passion Meets Purpose

At BWH® Hotels, we don't just offer employment opportunities, we create opportunities to be part of something extraordinary. As a global leader in hospitality for nearly 80 years, our vision is to inspire travel through unique experiences. Joining our corporate team means becoming part of a dynamic and inclusive community that values innovation, collaboration, and making a meaningful impact in the travel industry.

Headquartered in Phoenix, Arizona, BWH Hotels boasts a powerful portfolio of 18 brands, including WorldHotels™, Best Western® Hotels & Resorts, and SureStay Hotels®, with approximately 4,300 hotels in over 100 countries. We take pride in our top-ranking employee engagement scores and foster a workplace culture where your contributions truly matter. Join us and be part of a team that's shaping the future of hospitality!

Job Purpose:

Ensures the confidentiality, integrity, and availability of Company data and information technology assets by supporting governance, risk, and compliance activities, including security policy and standards management, risk management, disaster recovery coordination, audit readiness, and regulatory compliance. This role supports PCI DSS, SOX, privacy, and broader cybersecurity compliance activities across the organization.

Key Responsibilities:

• The ideal candidate will be able to build rapport and credibility with internal stakeholders, business partners, member hotel representatives, and technology teams to support effective governance, risk, and compliance outcomes. Excellent communication and interpersonal skills are required to coordinate evidence requests, explain control expectations, and drive timely follow-through.
• Demonstrated experience supporting compliance frameworks and control environments such as PCI DSS v4.0.1, NIST, COBIT, ISO 27001, SOX, privacy regulations, and related cybersecurity standards.
• Coordinate with internal stakeholders and external auditors to maintain current documentation for control scoping, evidence collection, testing support, remediation tracking, and validation of IT and cybersecurity controls.
• Work with stakeholders to fulfill evidence requests within committed timelines and ensure evidence is complete, accurate, and mapped to applicable control requirements.
• Conduct recurring control reviews with stakeholders to identify gaps, track remediation progress, and provide actionable advisement to management.
• Review audit findings, control gaps, and compliance risks; partner with control owners to document remediation plans, track progress, and elevate delays or blockers as appropriate.
• General understanding of Sarbanes-Oxley (SOX) compliance requirements, IT General Controls, and audit evidence expectations.
• Thorough knowledge of PCI-related standards and guidance, including PCI DSS v4.0.1, ASV requirements, payment security documentation, and software security requirements where applicable.
• Thorough understanding of applicable privacy and data protection requirements, including GDPR, the California Consumer Privacy Act (CCPA), and related organizational privacy obligations.
• Familiarity with a broad range of IT and information security products and technologies such as GRC platforms, central logging systems, file integrity monitoring, vulnerability management, endpoint security, and cloud security tools.
• Excellent documentation, communication, organization, and follow-through skills, with the ability to coordinate multiple evidence, audit, and remediation activities at the same time.

Preferred Experience and Education:

• Bachelor's or Master's degree in a computer or information management field or related experience preferred.
• CISSP, CISA, CISM, CRISC, or equivalent security, audit, risk, or compliance certification preferred.
• 3-5 years’ experience in an information security compliance, audit, governance, or risk management role with hands-on experience in compliance initiatives including, but not limited to:
• PCI DSS v4.0.1
• Software security, secure software lifecycle, or application security compliance requirements where applicable
• SOX-404 and IT General Controls
• EU-GDPR, CCPA, and related privacy or data protection requirements
• Strong analytical and problem-solving skills with the ability to interpret control requirements, identify risk, and function as a change agent.
• Intermediate to advanced expertise in Excel, PowerPoint, reporting, documentation, evidence tracking, and use of systems or repositories used to manage audit and compliance artifacts.
• Demonstrated experience working within a team in a fast-paced environment with competing audit, compliance, and operational priorities.
• Understanding of security metrics, compliance reporting, evidence tracking, and dashboard creation for management review and control-owner visibility.
• Demonstrated ability to create, maintain, and present security awareness, compliance, or control-owner training content a plus.

Work Location and Schedule

This is a hybrid position, requiring onsite presence Mondays, Wednesdays and Fridays at our Global Operations Center, with the option to work remote on Tuesdays and Thursdays. This hybrid model fosters intentional collaboration, teamwork, connection, and productivity, while still providing flexibility and work life balance. The office address is 20400 N 29th Avenue, Phoenix, Arizona 85027.

This position is not eligible for immigration sponsorship.

Benefits Summaryfor Full-Time Employees

• Medical/Dental/Vision available day one
• Vacation/Sick- accruals start day one
• Paid company holidays and personalholidays to celebrate what’s important to you
• 401K - company contribution and match (U.S.)
• Registered Retirement Savings Plan (RRSP) – company contribution and match (Canada)
• Employee discounts/hotel discounts
• Free financial and health wellness programs
• Tuition Reimbursement

Equal Employment Opportunity

BWH Hotels (the "Company") maintains a policy of equal employment opportunity for all employees and qualified applicants for employment without regard to race (including hair textures and hair styles associated with race), color or pigmentation, religion, religious creed (including religious dress and grooming practices), national origin, ancestry, alienage or citizenship status, caste, age, disability, gender, gender identity or expression, sex, sexual orientation, LGBTQIA+ individuals, height, weight, pregnancy status, childbirth or related medical conditions, genetic information, uniformed service or veteran status, marital status, or any other characteristic protected by applicable federal, state, provincial, or local laws. The Company’s equal employment opportunity policy applies to all aspects of employment with the Company, including, but not limited to, hiring, promotion, transfer, benefits, discipline, and termination.