Senior GRC Cybersecurity Analyst — Hybrid

Cybersecurity Jobs; Arlington (VA); Hybrid; USD 150,000 - 185,000; Full time

Job summary

National Rural Electric Cooperative Association (NRECA) is seeking a Senior Analyst to lead cybersecurity governance, risk, and compliance (GRC) initiatives. The role drives risk identification, lifecycle governance, and control effectiveness while coordinating remediation with regulators and external auditors.

You will work with IT and business units to develop risk registers, metrics, and policies, oversee third‑party security risk assessments, test controls, and report findings.

Qualifications

• 7+ years of IT and information security risk management experience.
• Experience leading information security risk assessments and third-party security risk assessments.
• Experience with GRC frameworks, standards, and best practices (NIST, HIPAA, SOC 2, CIS).

Responsibilities

• Advise IT and business units by leading activities to identify, assess, and prioritize cybersecurity risks.
• Partner with risk and control owners to develop, maintain risk registers and metrics; govern risks and mitigations.
• Manage compliance and issue management activities with regulators and auditors to track and remediate issues.
• Test controls for design and effectiveness and report findings and remediation status.
• Analyze findings to identify vulnerabilities and opportunities to strengthen controls and governance.

Skills

GRC governance

Risk management

Regulatory compliance

Stakeholder engagement

Audit coordination

Education

Bachelor degree in Computer Science / MIS / Information Security

CISSP

CRISC

CISA

CISM

Tools

AWS

Azure

M365

Job description

National Rural Electric Cooperative Association (NRECA) is seeking a Senior Analyst to lead cybersecurity governance, risk, and compliance (GRC) initiatives. The role drives risk identification, lifecycle governance, and control effectiveness while coordinating remediation with regulators and external auditors.

You will work with IT and business units to develop risk registers, metrics, and policies, oversee third‑party security risk assessments, test controls, and report findings.