Senior GRC Cybersecurity Lead (Hybrid)

National Rural Electric Cooperative Association; Arlington (VA); Hybrid; USD 150,000 - 185,000; Full time

Job summary

NRECA in Arlington, VA, is seeking a Senior Cybersecurity Governance, Risk, and Compliance Lead. This role drives risk identification, assessment, prioritization, and lifecycle governance, partnering with IT and business units to strengthen controls and ensure regulatory alignment.

The position supports third‑party risk management, testing of controls, and reporting on findings, with hybrid work options allowing up to two days remote per week.

Qualifications

• Bachelor's degree in CS/MIS/InfoSec or related field.
• 7+ years in IT info security risk management, compliance, audit, governance.
• 7+ years leading security risk assessments and third-party risk.
• Strong knowledge of AWS, Azure, M365.
• Experience with NIST CSF, RMF, 800-30/53/171, HIPAA, SOC2, CIS, ISO 27001/27002, COBIT.
• Experience with GRC tools, reports and dashboards.

Responsibilities

• Identify, assess, and prioritize cybersecurity risks across IT and business units.
• Manage risk registers, metrics, and governance reporting.
• Coordinate with regulators and auditors for remediation and controls testing.
• Advise leaders on mitigating vulnerabilities and risk prioritization.
• Lead third-party risk management policy development and assessments.
• Define risk requirements for systems across cloud, on‑prem, and third‑party environments.

Skills

Risk management

Compliance governance

Third‑party risk

NIST frameworks

Education

Bachelor's in Computer Science or related field

Tools

AWS

Azure

M365

Job description

NRECA in Arlington, VA, is seeking a Senior Cybersecurity Governance, Risk, and Compliance Lead. This role drives risk identification, assessment, prioritization, and lifecycle governance, partnering with IT and business units to strengthen controls and ensure regulatory alignment.

The position supports third‑party risk management, testing of controls, and reporting on findings, with hybrid work options allowing up to two days remote per week.