Lead IT GRC Analyst (Policy Management)

Nbcuniversal3; United States; Vor Ort; USD 120.000 - 150.000; Vollzeit

Zusammenfassung

The Lead IT GRC Analyst will lead the operational execution, integration, and continuous improvement of the Cyber Governance & Controls function across the enterprise. This role partners with Cybersecurity, Legal, Privacy, Audit, Procurement, and business stakeholders to establish ownership, evidence, review cadences, and sustainable governance outcomes.

Responsibilities include managing governance operations, policy and standards lifecycle, risk acceptance processes, and service enablement.

Qualifikationen

• Experience implementing governance programs and controls.
• Ability to coordinate cross-functional governance efforts.

Aufgaben

• Develop, implement, and continuously improve Governance operating procedures, playbooks, lifecycle schedules, decision records, and recurring operating rhythms.
• Coordinate policy forums, standards review, governance working sessions, steering decisions, escalations, action-item closure, and quarterly operating reviews.

Jobbeschreibung

The Lead IT GRC Analyst will lead the operational execution, integration, and continuous improvement of the Cyber Governance & Controls function. This role will support turning a broad portfolio of governance work including policies, standards, configuration baselines, Cybersecurity Risk Acceptance Memoranda, long-term governance models, control libraries, and governance advisory engagements into a coordinated, measurable enterprise service.

This role will partner across Cybersecurity, Operations & Technology, Legal, Privacy, Audit, Procurement, and various business stakeholders to establish clear ownership, decision rights, evidence, review cadences, exception paths, and sustainable control outcomes.

This role enables delivery across eight connected service lines: policy and standards lifecycle management; security baselines and control governance; vendor security management; continuous third-party monitoring; GRC tooling and workflow automation; data protection governance; program governance advisory; and regulatory, audit, and standards interpretation. The position is differentiated from traditional project management by its accountability for the operating health, maturity, adoption, traceability, and effectiveness of Governance itself.

Responsibilities

Governance Operations

• Develop, implement, and continuously improve Governance operating procedures, playbooks, lifecycle schedules, decision records, and recurring operating rhythms.
• Coordinate policy forums, standards review, governance working sessions, steering decisions, escalations, action-item closure, and quarterly operating reviews.
• Serve as coordinator for the Global Cybersecurity Governance Steering Committee, including agenda planning, materials, stakeholder alignment, decision tracking, action-item follow-through, and governance reporting.
• Chair the Global Cybersecurity Governance Working Group, facilitating cross-functional discussion, driving alignment on governance priorities, escalating decisions as needed, and ensuring actions are assigned, documented, and completed.
• Define and maintain roles, decision rights, RACIs, reviewers, approvers, accountable service owners, evidence expectations, and exception paths across Governance services.
• Establish a consistent definition of done for governance outcomes spanning ownership, documented requirements, operational process, automation, monitoring, metrics, exceptions, and recurring review.
• Separate administrative, technical, and operational governance so that requirements are not only approved, but implemented, monitored, evidenced, and sustained.

Policy, Standards, Baselines & Risk Acceptance Governance

• Operate the end-to-end lifecycle for cyber policies, standards, configuration baselines, procedures, and supporting guidance, including intake, drafting, stakeholder review, approval, publication, communication, maintenance, and retirement.
• Maintain the Cyber Policy Library, authoritative document hierarchy, review calendar, approval evidence, version history, control mappings, glossary, and publication quality controls.
• Coordinate development and renewal of Cybersecurity Risk Acceptance Memoranda, including validated current-state data, residual-risk statements, accountable owners, corrective-action plans, milestones, approval records, audit dependencies, reporting, and retirement criteria.
• Help transition broad, recurring risk acceptances toward targeted, risk-based exception and monitoring processes where sustainable ownership and evidence can be established.
• Support requirement-centric governance by mapping policies, standards, baselines, and controls to authoritative frameworks and identifying opportunities to automate governance workflows, document reviews, approval processes, and evidence collection.

Service Management & Enablement

• Maintain the Cyber Governance & Controls service catalog, definitions, owners, RACIs, inputs, outputs, dependencies, intake paths, service levels, and records of authority.
• Coordinate operational visibility across policy and standards, control baselines, vendor security, continuous third-party monitoring, GRC tooling, data protection, governance advisory, and audit and standards interpretation.
• Develop and administer common intake, triage, prioritization, status, decision, escalation, evidence, and closure practices while preserving accountability with service owners.
• Measure demand, throughput, aging, adoption, quality, stakeholder experience, control effectiveness, and operational health across the Governance portfolio.
• Identify work already delivered through remediation and transformation programs and make it visible through consistent governance tagging, ownership, reporting, and sustainment criteria.
• Improve self-service through clear guidance, reusable patterns, decision trees, communications, training, and content structured for both people