Senior Analyst, GRC - Remote

DriveTime; United States; Remote; USD 100,000 - 170,000; Full time

Job summary

DriveTime is seeking a seasoned Sr. GRC Analyst to lead Information Security risk assessments and governance across our organization. You will translate technical findings into clear business risks and drive practical risk reduction with cross‑functional teams.

Responsibilities include compliance monitoring, policy governance, audits, due diligence, and security awareness. Candidates will hold a related bachelor’s degree and 4+ years in GRC or cybersecurity roles.

Qualifications

• Experience conducting risk assessments, documenting findings, and recommending remediation actions.
• Ability to translate technical findings into business risk statements and practical guidance.
• Bachelor’s degree or equivalent combination of education and experience in a related field.

Responsibilities

• Lead Information Security risk assessments and cyber risk management activities.
• Monitor compliance with policies, standards, frameworks, and regulatory requirements.
• Support policy governance, audits, third-party security assessments, and awareness programs.
• Provide risk guidance, reporting, and process-improvement recommendations.
• Coordinate evidence collection for internal and external audits and remediation efforts.
• Assess third‑party vendors and address identified risks in collaboration with business partners.

Skills

Cybersecurity risk management

Governance

Security controls

Compliance methodologies

Communication

Analytical thinking

Problem solving

Education

Bachelor's degree in Information Security/Cybersecurity/IT/Business/Audit

Job description

What's Under the Hood

DriveTime Family of Brands is the largest privately owned used car sales finance & servicing company in the nation. Headquartered in Tempe, Arizona and Dallas, Texas, we create opportunities and improve the lives of our customers and our employees by placing a focus on putting the right customer, in the right vehicle, on the right terms and on their path to ownership. The DriveTime Family of Brands spans across DriveTime , Bridgecrest and SilverRock. You can find us at the intersection of technology and innovation as we use our proprietary tools and over two decades of industry knowledge to redefine the process of purchasing, financing, and protecting your vehicle.

In short, this role is for a seasoned cybersecurity professional who thrives at the intersection of governance, risk, compliance, and business partnership. As a Sr. GRC Analyst, you will play a key role in helping the organization identify, assess, manage, and communicate cybersecurity risk while supporting compliance obligations, audits, policy governance, third-party security reviews, and security awareness initiatives. You'll serve as a trusted advisor across the business, translating technical security findings into meaningful business risk and driving practical solutions that strengthen the organization's security posture.

Responsibilities

• Leading Information Security risk assessments and cyber risk management activities, including risk identification, analysis, scoring, treatment planning, documentation, tracking, and reporting.
• Performing Information Security compliance monitoring and control assessments against policies, standards, frameworks, contractual obligations, and regulatory requirements.
• Leading assigned GRC services such as policy governance, audit support, third-party security assessments, due diligence activities, and security awareness programs.
• Providing subject matter expertise, risk guidance, reporting, process improvement recommendations, and mentorship within the GRC function.
• Independently facilitating risk assessments and evaluating control effectiveness across technology and business environments.
• Developing clear risk statements and practical risk treatment recommendations for management review and decision‑making.
• Supporting internal and external audits by coordinating evidence collection, interpreting requests, and tracking remediation efforts.
• Conducting cybersecurity assessments of third‑party vendors and collaborating with business partners to address identified risks.
• Coordinating responses to security due diligence questionnaires, insurance inquiries, and external security assessments.
• Managing the Information Security policy lifecycle, including drafting, reviewing, updating, tracking approvals, and supporting periodic reviews.
• Supporting and enhancing security awareness and education initiatives through communications, campaigns, training content, and reporting.
• Maintaining GRC processes, procedures, methodologies, and performance metrics while identifying opportunities for continuous improvement.
• Providing guidance and mentoring to less‑experienced analysts and promoting consistent GRC practices across the organization.
• Performing other duties as assigned.

So What Kind of Folks Are We Looking For?

• Strong understanding of cybersecurity risk management, governance principles, security controls, and compliance assessment methodologies.
• Ability to translate technical security findings into clear business risks and actionable recommendations.
• Strong analytical, critical‑thinking, and problem‑solving skills.
• Excellent written and verbal communication abilities with the confidence to engage stakeholders at all levels.
• Ability to facilitate discussions and present complex information to technical and non‑technical audiences.
• Strong organizational skills with the ability to prioritize multiple projects and deadlines.
• Collaborative mindset with the ability to build effective partnerships across Information Security, Technology, Legal, Compliance, Internal Audit, Vendor Management, and business teams.
• Self‑starter mentality with the ability to take ownership of programs, services, and process improvements.
• Passion for mentoring and developing others while fostering high‑quality and consistent work practices.
• Strong attention to detail and commitment to continuous learning in the cybersecurity and risk landscape.

The Specifics

• 4+ years of experience in Information Security GRC, cybersecurity risk management, IT compliance, IT audit, security assurance, or a related discipline.
• Bachelor's degree in Information Security, Cybersecurity, Information Technology, Business, Risk Management, Audit, or a related field, or an equivalent combination of education and experience.
• Demonstrated experience independently conducting risk assessments, evaluating controls, documenting findings, and developing remediation or risk treatm