Security Governance Analyst - GRC

DPR Construction; Phoenix (AZ); On-site; USD 100,000 - 150,000; Full time

Job summary

DPR Construction in Phoenix, AZ is seeking a Security Governance Analyst to design, implement, and monitor governance frameworks, perform risk assessments, and drive regulatory and contractual compliance across multiple business units.

You will lead complex assessments, collaborate with security teams and stakeholders, and provide remediation guidance. A bachelor’s in a relevant field and 4–6 years' experience are required, with CRISC/CISSP/CCSP preferred.

Qualifications

• Bachelor’s degree in cybersecurity, information systems, business, law, or related field.
• 4–6 years of information security governance, compliance, or risk management.
• CRISC, CISSP, CCSP preferred; background check required.

Responsibilities

• Leads enterprise and third-party risk assessments of moderate to high complexity across multiple systems and vendors.
• Conducts detailed evaluations of governance, privacy, and access controls and provides formal remediation recommendations to stakeholders.
• Assesses systems, vendors, and integrations for regulatory and contractual compliance impact and documents comprehensive control gap analysis.
• Coordinates audit support activities and validates remediation evidence across multiple initiatives and stakeholders.
• Performs and reviews access governance processes, control testing activities, and compliance documentation to ensure defensibility.
• Develops comprehensive governance reporting insights to support executive risk visibility and compliance tracking.
• Provides structured guidance and quality review support to governance analysts to ensure assessment rigor and consistency.

Skills

Security governance

Risk assessments

Compliance

Industry standards

Stakeholder comms

Education

Bachelor’s degree in cybersecurity, information systems, business, law, or related field

Job description

Job Description

The Security Governance Analyst is responsible for designing, implementing, and monitoring security governance frameworks, conducting risk assessments, and ensuring compliance with internal policies, industry standards, and applicable laws. This role bridges technical security teams, business units, and compliance functions

At DPR, roles and responsibilities are more than describing a job title—they are a commitment to building great things together. The job description(s) below defines core responsibilities and the scope of the role and is a starting point. Every employee is expected to lead from where they are, take ownership of outcomes, and always act in the best interest of the team, customer, project and organization.

As a purpose-driven organization on a journey to be most admired, we rely on trust, shared leadership, open communication, disciplined action and a deep respect for the individual to drive exceptional performance. Success is not just about what we build, but who we build and how we build it: with integrity, enjoyment, uniqueness and an ever-forward mindset.

Job Summary:

Independently executes complex governance and risk assessments and drives comprehensive evaluation of control effectiveness to ensure alignment with enterprise policies and applicable regulatory and contractual requirements across multiple business units.

Key Responsibilities:

• Leads enterprise and third-party risk assessments of moderate to high complexity across multiple systems and vendors.
• Conducts detailed evaluations of governance, privacy, and access controls and provides formal remediation recommendations to stakeholders.
• Assesses systems, vendors, and integrations for regulatory and contractual compliance impact and documents comprehensive control gap analysis.
• Coordinates audit support activities and validates remediation evidence across multiple initiatives and stakeholders.
• Performs and reviews access governance processes, control testing activities, and compliance documentation to ensure defensibility.
• Develops comprehensive governance reporting insights to support executive risk visibility and compliance tracking.
• Provides structured guidance and quality review support to governance analysts to ensure assessment rigor and consistency.

Education Qualifications:

Bachelor’s degree in cybersecurity, information systems, business, law, or a related field required.

Work Experience:

4–6 years of experience in information security governance, compliance, or risk management required. Including independent leadership of complex assessments.

Certifications and Licenses:

• Relevant certification preferred (e.g., Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP))
• Successful completion of a background check is required.

DPR Construction is a forward-thinking, self-performing general contractor specializing in technically complex and sustainable projects for the advanced technology, life sciences, healthcare, higher education and commercial markets. Founded in 1990, DPR is a great story of entrepreneurial success as a private, employee-owned company that has grown into a multi-billion-dollar family of companies with offices around the world.

Working at DPR, you’ll have the chance to try new things, explore paths and shape your future. Here, we build opportunity together—by harnessing our talents, enabling curiosity and pursuing our collective ambition to make the best ideas happen. We are proud to be recognized as a great place to work by our talented teammates and leading news organizations like U.S. News and World Report, Forbes, Fast Company and Newsweek.