Senior IT GRC & Cyber Risk Analyst

Kennesaw State University; Kennesaw (GA); On-site; USD 110,000 - 150,000; Full time

Job summary

Kennesaw State University seeks a senior IT risk and cybersecurity governance professional to lead risk assessments, keep the risk register, and coordinate third-party risk and audits. The role supports GLBA, HIPAA, FERPA, PCI-DSS, and NIST controls while collaborating with research and IT teams across campus.

The position emphasizes policy development, remediation planning, and executive reporting to drive risk-informed decisions in a large public university environment.

Qualifications

• Bachelor's degree or equivalent experience in IT, security, or risk domains.
• 5+ years in governance, risk, compliance, or related fields.

Responsibilities

• Lead IT cybersecurity risk assessments using NIST, CIS, and institutional frameworks.
• Maintain enterprise risk register with ownership, remediation tracking, and acceptance processes.
• Coordinate third-party vendor risk assessments including SOC reports and questionnaires.
• Support audit readiness activities and remediation tracking for cybersecurity and regulatory audits.
• Assess controls against GLBA, HIPAA, FERPA, PCI-DSS, NIST, and related standards.
• Develop and maintain cybersecurity policies, standards, and governance documentation.
• Collaborate with stakeholders to identify risks and remediation actions.

Skills

Governance

Risk management

Compliance

Vendor risk

Audit readiness

Communication

Analytical thinking

Education

Bachelor's degree

Advanced degree preferred

Tools

ServiceNow GRC

RSA Archer

OneTrust

Apptega

Job description

Kennesaw State University seeks a senior IT risk and cybersecurity governance professional to lead risk assessments, keep the risk register, and coordinate third-party risk and audits. The role supports GLBA, HIPAA, FERPA, PCI-DSS, and NIST controls while collaborating with research and IT teams across campus.

The position emphasizes policy development, remediation planning, and executive reporting to drive risk-informed decisions in a large public university environment.