IT GRC Analyst II

State Employees' Credit Union; Raleigh (NC); On-site; USD 90,000 - 120,000; Full time

Job summary

State Employees' Credit Union is seeking an IT GRC Analyst II to assess, test, document, and monitor the technology ecosystem, ensuring the IT control environment mitigates risks amid evolving threats. This role bridges technology groups and business units, requiring a broad perspective and ability to manage end-to-end risk processes.

The candidate will perform technology risk assessments, help document IT policies and standards, develop remediation plans, and aggregate risk metrics for senior

Qualifications

• 5+ years of IT Security and/or IT Risk Management experience.
• Ability to document policies, standards, and guidelines.
• Experience with risk aggregation, KPI/KRI reporting, and remediation tracking.
• Familiarity with frameworks (NIST, ISO 27001, SoGP) and third-party risk management.

Responsibilities

• Identify, document, and monitor technology risks across internal and external environments.
• Quantify inherent and residual IT risk levels to inform prioritizations and reporting.
• Collaborate with remediation owners to establish plans with milestones and dates and monitor progress.
• Support continuous improvement of risk management processes and program design.
• Perform risk and controls assessments and contribute to audit/regulatory reporting.
• Partner with stakeholders to establish clear IT risk reporting, metrics, and KPIs.

Skills

IT Security

IT Risk Management

Communication skills

Teamwork

Risk reporting

Job description

Position Overview:

The IT GRC Analyst II assess, tests, documents, and monitors the SECU technology ecosystem to ensure the IT control environment effectively mitigates risks associated with an everchanging threat landscape. The IT GRC Analyst will possess a wide range of technical and interpersonal skills to bridge the gap between technology organizations and the business. Must have a big-picture perspective, ability to execute end-to-end risk management processes, and ability to quickly establish trust and build productive relationships across multiple departments. The IT GRC Analyst will require expertise to perform technology risk assessments, provide input to and/or document IT policies, standards, and guidelines, develop, monitor, and track risk remediation plans, and aggregate and report key risk metrics to senior stakeholders.

Responsibilities:

• 20% Identify, document, and monitor technology risks present across both internal and external (vendor / cloud) environments
• 20% Quantify inherent and residual IT risk levels to enhance analytics, inform prioritizations, and for use in management reporting
• 20% Work with risk remediation owners to establish remediation plans with milestones and target dates, and monitor progress towards remediation, escalating as appropriate
• 20% Execute technology risk management processes and provide input to support continuous improvement of process and program design
• 10% Perform risk and controls assessments while aggregating reporting for Audit and/or Regulatory issues.
• 10% Partner with relevant stakeholders to establish clear and consistent IT risk reporting, metrics, KRIs, and KPIs to inform decision making

Required Relevant Experience:

Minimum 5 years

Knowledge, Abilities, Skills:

Teamwork, collaboration, self-driven and effective communication skills - both written and verbal. 5 years of IT Security and/or IT Risk Management experience working in a mid-to-large size company Basic proficiency or ability to learn one or more of the following: Risk and controls assessments Documenting and maintaining IT Policies / Standards IT Risk aggregation, reporting, KPI/KRIs Issues management Third party risk management Working knowledge of various industry security standards and frameworks including: NIST, ISO 27001, ISF Standard of Good Practice (SoGP), etc.

Desired Knowledge, Abilities, Skills:

5+ years working in a financial institution. Knowledge of modern enterprise and security architectures, their challenges, common approaches to overcome their challenges, and their inherent security strengths and weaknesses. Professional certifications such as: CISSP, CISA, CISM, GIAC, CGEIT, CRISC, OSCE, or other relevant industry certification Experience working within a DevOps environment

SECU provides equal employment opportunity to all qualified persons regardless of race, color, religion, age, sex, sexual orientation, gender identity, national origin, genetic information, disability, veteran status, or other classification protected by law.

Disclaimer:

State Employees' Credit Union reserves the right to fill this role at a higher/lower level based on business need.

State Employees' Credit Union is a not-for-profit, member-owned financial cooperative with a "Do the Right Thing" mission and a goal of helping people in our community. SECU values the differences in our staff and in our North Carolina communities. We believe that embracing the uniqueness of individuals makes our cooperative stronger, more innovative and better able to serve SECU members.