Senior GRC & Data Governance Security Analyst

BlueCross BlueShield of Tennessee; United States; Remote; USD 120,000 - 190,000; Full time

Job summary

BlueCross BlueShield of Tennessee is seeking a Senior Information Security Governance, Risk and Compliance (GRC) Analyst to lead the application security risk program, focusing on SAST/DAST, vulnerability management, and risk communication. You will partner across teams to prioritize remediation and strengthen security posture.

The role requires 5+ years in information security with 2+ years in GRC, and certifications such as CISSP/CRISC/CISA/CISM are preferred.

Qualifications

• Bachelor’s degree or equivalent (4 years) required.
• 5 years of professional information security experience with 2+ years in GRC.
• Certifications such as CISSP, CRISC, CISA or CISM preferred.
• Experience with AI-enabled tools to automate GRC processes is a plus.

Responsibilities

• Lead SOC 2 Audit Support – Coordinate audit activities including evidence collection, control validation, and auditor engagement.
• Manage and Validate Control Frameworks – Maintain control documentation, mappings, and narratives with owners to ensure effectiveness and alignment with criteria.
• Track Audit & Remediation Activities – Oversee findings, remediation efforts, and timely closure of issues.
• Develop & Maintain NIST SSPs – Create and update System Security Plans, including control implementations and system boundaries.
• Drive Security Awareness Programs – Design and manage training initiatives, including phishing simulations.

Skills

Risk assessment

GRC processes

Security governance

Vulnerability management

Audit coordination

Education

Bachelor’s degree or equivalent (4 years)

Tools

SAST/DAST tools

NIST frameworks

Job description

BlueCross BlueShield of Tennessee is seeking a Senior Information Security Governance, Risk and Compliance (GRC) Analyst to lead the application security risk program, focusing on SAST/DAST, vulnerability management, and risk communication. You will partner across teams to prioritize remediation and strengthen security posture.

The role requires 5+ years in information security with 2+ years in GRC, and certifications such as CISSP/CRISC/CISA/CISM are preferred.