Sr Analyst GRC Cybersecurity

NRECA International; Arlington (VA); Hybrid; USD 130,000 - 170,000; Full time

Benefits offered by this job

Hybrid work schedule (up to 2 days rem

Job summary

NRECA International is seeking a Cybersecurity Governance professional to lead risk identification, assessment, and lifecycle governance for our enterprise. This role partners with IT and business leaders to strengthen controls, ensure regulatory compliance, and improve governance processes in a hybrid work environment.

The position emphasizes collaborating with stakeholders to prioritize risks, manage third‑party risk, and report on security metrics.

Qualifications

• Experience leading cybersecurity governance programs across an enterprise.
• Ability to analyze findings and advise on mitigation strategies.

Responsibilities

• Lead activities identifying, assessing, and prioritizing cybersecurity risks and controls.
• Develop and maintain risk registers, metrics, and governance policies.
• Coordinate with regulators and auditors to track and remediate issues.
• Test controls for design and effectiveness and monitor remediation status.
• Advise leaders on improvements and risk escalations.
• Facilitate monthly security risk meetings and report metrics.
• Guide third‑party risk management and assessments.
• Define risk requirements for systems across cloud, on premise, and third‑party environments.

Skills

Cybersecurity governance

Risk assessment

Regulatory compliance

Stakeholder advisory

Job description

Job Description

NRECA is a unique national trade association providing advocacy, financial services and business support services to over 900 consumer owned electric cooperatives across the country. NRECA employees are united by our mission, inclusive culture, collaborative workplace and commitment to service excellence. As a “best place to work” employer, we operate with integrity, transparency and a spirit of innovation.

Job Description

NRECA is a unique national trade association providing advocacy, financial services and business support services to over 900 consumer owned electric cooperatives across the country. NRECA employees are united by our mission, inclusive culture, collaborative workplace and commitment to service excellence. As a “best place to work” employer, we operate with integrity, transparency and a spirit of innovation.

Join IT at NRECA where we are more than a team, we are a community. Guided by the core tenets of Simplicity, Security, Continuity, Transparency, and Flexibility, we strive to deliver business value through collaboration, ideation, and innovation. Become an integral part of a community driven to continuously improve our processes and transform how we work – in partnership with our colleagues and in service to our members.

This position leads key functions within Cybersecurity Governance, Risk, and Compliance, including cybersecurity risk identification, assessment, prioritization, and lifecycle governance, as well as compliance and issue management. The ideal candidate will have experience analyzing findings to strengthen controls, improve governance processes, and advise IT and business stakeholders on mitigation strategies.

This position is eligible for NRECA’s hybrid schedule which allows for flexibility to work from home up to 2 days per/week.

Key Responsibilities

• Advises IT and business units by leading activities to identify, assess, and prioritize cybersecurity risks, ensuring alignment with legal, regulatory, contractual, policy, and standard requirements.
• Partners with risk and control owners to develop, implement, and maintain risk registers and metrics; governs and reports on risks and mitigations throughout the lifecycle; maintains risk management policies, standards, and the assessment plan.
• Manages compliance and issue management activities, coordinating with regulators and auditors to track and remediate issues. Tests controls for design and effectiveness and partners with owners to implement remediation, reporting on findings and status.
• Analyzes findings to identify vulnerabilities and opportunities to strengthen controls, governance, and mitigation. Proactively advises leaders on improvements and ensures proper prioritization and escalation of risks.
• Performs cybersecurity risk governance, ensuring activities follow the governance framework and reporting on conformance.
• Facilitates monthly security risk meetings to report activities, metrics, risks, and improvement opportunities.
• Optimizes the risk governance framework based on best practices and guides IT and business stakeholders in implementing governance requirements.
• Leads development of third-party risk management policies and standards and advises on the annual assessment plan; works closely with stakeholders on third party assessments and risk management. ‑party risk management policies and standards and party assessments and risk management.
• Defines risk and control requirements for systems, data, and technology across cloud, on premises, and third-party environments; assesses system designs for risks and cybersecurity noncompliance. ‑premises, and third‑party environments; assesses system designs