GRC Analyst: Risk, Compliance & Resilience

jeffersonhealth; Pennsylvania; On-site; USD 90,000 - 120,000; Full time

Job summary

Jefferson Health seeks an information security professional to contribute to governance, risk and compliance programs, applying security policies, risk assessments, and organizational resilience practices to protect critical assets.

This role collaborates with teams to develop KPIs and support awareness campaigns, tabletop exercises, and risk quantification to improve security posture and regulatory alignment.

Qualifications

• Bachelor's degree in a science/tech/engineering/math field or equivalent.
• High School Diploma or GED with preferred certifications.
• At least 3 years of related work experience.

Responsibilities

• Contribute to the implementation of an integrated Governance, Risk, and Compliance (GRC) program and tools to support GRC workflows.
• Apply enterprise information security policies, standards, and procedures to ensure robust security and resilience.
• Perform risk assessments including business impact and third-party risk, and analyze cloud systems.
• Prioritize and deploy risk mitigation strategies with cross-functional coordination.
• Support security awareness and resilience training campaigns and tabletop exercises.
• Collaborate with team members to interpret requirements and resolve GRC-related issues.
• Contribute to KPI development and risk quantification to measure trends and compliance metrics.

Skills

Regulatory compliance

Risk management

Security data engineering

Organizational resilience

Education

Bachelor's Degree in STEM fields (sciences/tech/engineering/math)

High School Diploma/GED with preferred certifications

Tools

GRC tools

Job description

Jefferson Health seeks an information security professional to contribute to governance, risk and compliance programs, applying security policies, risk assessments, and organizational resilience practices to protect critical assets.

This role collaborates with teams to develop KPIs and support awareness campaigns, tabletop exercises, and risk quantification to improve security posture and regulatory alignment.