Senior GRC Analyst - Remote

DriveTime; Tempe (AZ); Hybrid; USD 120,000 - 160,000; Full time

Benefits offered by this job

Work From Home

Medical, dental, and vision coverage

401(K) plan

Life insurance

Disability coverage

Tuition reimbursement

Wellness program

Paid Time Off

Job summary

DriveTime Family of Brands is seeking a Sr. GRC Analyst in Tempe, AZ to join a seasoned governance, risk and compliance team. You will translate security findings into business risk, drive risk management, and support audits, policy governance, and vendor risk reviews.

You will mentor others, lead risk assessments, and advance security awareness across the organization while collaborating with Legal, IT, Compliance, and Internal Audit to strengthen the company’s security posture.

Qualifications

• 4+ years of experience in Information Security GRC, cybersecurity risk management, IT compliance, IT audit, or related discipline.
• Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Business, Risk Management, Audit, or related field, or equivalent.
• Demonstrated experience independently conducting risk assessments, evaluating controls, and developing remediation or risk treatment recommendations.

Responsibilities

• Leading Information Security risk assessments and cyber risk management activities, including risk identification, analysis, scoring, treatment planning, documentation, tracking, and reporting.
• Performing Information Security compliance monitoring and control assessments against policies, standards, frameworks, contractual obligations, and regulatory requirements.
• Leading GRC services such as policy governance, audit support, third-party security assessments, due diligence activities, and security awareness programs.
• Providing subject matter expertise, risk guidance, reporting, and process improvement recommendations within the GRC function.
• Independently facilitating risk assessments and evaluating control effectiveness across technology and business environments.
• Developing clear risk statements and practical risk treatment recommendations for management review and decision-making.
• Supporting internal and external audits by coordinating evidence collection, interpreting requests, and tracking remediation efforts.
• Conducting cybersecurity assessments of third-party vendors and addressing identified risks with business partners.
• Coordinating responses to security due diligence questionnaires, insurance inquiries, and external security assessments.
• Managing the Information Security policy lifecycle, including drafting, reviewing, updating, tracking approvals, and supporting reviews.
• Supporting and enhancing security awareness and education initiatives through communications and training.
• Maintaining GRC processes, methodologies, and performance metrics while identifying opportunities for improvement.
• Providing guidance and mentoring to less-experienced analysts and promoting consistent GRC practices.
• Performing other duties as assigned.

Skills

Cybersecurity risk management

Governance

Compliance assessment

Stakeholder communication

Mentorship

Analytical thinking

Problem solving

Organizational skills

Education

Bachelor's degree in Information Security, Cybersecurity, IT, Business, Risk Management, Audit, or related field

Tools

NIST CSF

Job description

DriveTime Family of Brands is seeking a Sr. GRC Analyst in Tempe, AZ to join a seasoned governance, risk and compliance team. You will translate security findings into business risk, drive risk management, and support audits, policy governance, and vendor risk reviews.

You will mentor others, lead risk assessments, and advance security awareness across the organization while collaborating with Legal, IT, Compliance, and Internal Audit to strengthen the company’s security posture.