GRC Cybersecurity Policy & Risk Analyst

Vanguard; Dallas (TX); On-site; USD 90,000 - 125,000; Full time

Job summary

Vanguard is seeking a Governance, Risk & Compliance Analyst, Specialist to lead enterprise‑wide information security policies and standards. You will translate regulatory and business needs into audit‑ready policy language, ensure standards stay current, and collaborate with stakeholders to reduce ambiguity and enable teams to operate within defined risk controls.

You will assess the end‑to‑end GRC framework, monitor policy lifecycles, and use data‑driven methods to predict risk issues and craft

Qualifications

• Five years related work experience in Information Security or fraud.
• Undergraduate degree or equivalent; Computer Science preferred.
• In-depth knowledge of NIST CSF, NIST 800-53, CIS Controls, ISO 27002 and financial services cyber regulations.
• Experience with GRC solutions platforms and automation capabilities.
• Excellent communication and influencing skills.
• Influence key stakeholders and security policy owners.
• Professional certification (CISSP, CISM, CompTIA, SANS, ISC2) preferred.

Responsibilities

• Serve as the technical authority on security of applications and systems.
• Conduct security and fraud assessments and risk analyses.
• Develop and maintain policies and standards portfolio; monitor lifecycle.
• Advise stakeholders during policy discussions; interface with regulators.
• Define automations to accelerate delivery and improve effectiveness.
• Design data-driven dashboards to predict risk issues and partner with owners.
• Support modernized GRC process and tooling across the company.

Skills

GRC

InfoSec

Policy development

Automation

Stakeholder mgmt

Education

Undergraduate degree

Computer Science degree preferred

Tools

GRC platform

Automation tools

Job description

Vanguard is seeking a Governance, Risk & Compliance Analyst, Specialist to lead enterprise‑wide information security policies and standards. You will translate regulatory and business needs into audit‑ready policy language, ensure standards stay current, and collaborate with stakeholders to reduce ambiguity and enable teams to operate within defined risk controls.

You will assess the end‑to‑end GRC framework, monitor policy lifecycles, and use data‑driven methods to predict risk issues and craft