Senior Information Security Risk & GRC Lead

BlueCross BlueShield of Tennessee, Inc.; Chattanooga (TN); Hybrid; USD 120,000 - 150,000; Full time

Job summary

BCBST BlueCross BlueShield of Tennessee, Inc. seeks a Senior Information Security Risk Analyst on the GRC team to lead application security risk management and oversee SAST/DAST programs.

You will translate complex findings into actionable business risk insights and drive remediation with application teams and stakeholders. You will also support enterprise data governance initiatives, assess regulatory requirements, and communicate risk to technical and non-technical audiences across the

Qualifications

• Bachelor’s degree in a relevant field or four years of equivalent experience.
• 5 years in information security or related IT roles with at least 2 years in GRC (Governance, Risk & Compliance).
• Experience leveraging AI-enabled tools to automate GRC processes, improving efficiency and scalability.
• Certifications: CISSP, CRISC, CISA, or CISM.
• Ability to assess organizational risks and apply regulatory requirements (NIST, SOC 2, HIPAA).
• Strong communication to technical and non-technical stakeholders.
• Experience supporting SOC 2 audits, NIST frameworks, SSP development, and third-party risk management.

Responsibilities

• Lead SOC 2 Audit Support – coordinate audit activities and evidence collection.
• Manage and Validate Control Frameworks – maintain mappings and narratives with control owners.
• Track Audit & Remediation Activities – oversee findings and remediation timelines.
• Develop & Maintain NIST SSPs – create and update system security plans.
• Drive Security Awareness Programs – design training and phishing simulations.
• Manage Policies & Governance Documentation – oversee policies, standards and procedures.
• Conduct Enterprise & Third‑Party Risk Management – perform risk assessments and monitor remediation.
• Oversee Vulnerability Management – track remediation against SLAs.
• Support Customer Security Assurance – respond to security questionnaires and RFPs.
• Leadership – promote collaboration across GRC areas.

Skills

Application security

Risk assessment

GRC

SAST/DAST

Vulnerability management

Stakeholder communication

Education

Bachelor’s degree in a relevant field

Tools

SAST/DAST platforms

AI-enabled GRC tools

Job description

BCBST BlueCross BlueShield of Tennessee, Inc. seeks a Senior Information Security Risk Analyst on the GRC team to lead application security risk management and oversee SAST/DAST programs.

You will translate complex findings into actionable business risk insights and drive remediation with application teams and stakeholders. You will also support enterprise data governance initiatives, assess regulatory requirements, and communicate risk to technical and non-technical audiences across the