Sr Analyst GRC Cybersecurity

Cybersecurity Jobs; Arlington (VA); Hybrid; USD 150,000 - 185,000; Full time

Job summary

National Rural Electric Cooperative Association (NRECA) is seeking a Senior Analyst to lead cybersecurity governance, risk, and compliance (GRC) initiatives. The role drives risk identification, lifecycle governance, and control effectiveness while coordinating remediation with regulators and external auditors.

You will work with IT and business units to develop risk registers, metrics, and policies, oversee third‑party security risk assessments, test controls, and report findings.

Qualifications

• 7+ years of IT and information security risk management experience.
• Experience leading information security risk assessments and third-party security risk assessments.
• Experience with GRC frameworks, standards, and best practices (NIST, HIPAA, SOC 2, CIS).

Responsibilities

• Advise IT and business units by leading activities to identify, assess, and prioritize cybersecurity risks.
• Partner with risk and control owners to develop, maintain risk registers and metrics; govern risks and mitigations.
• Manage compliance and issue management activities with regulators and auditors to track and remediate issues.
• Test controls for design and effectiveness and report findings and remediation status.
• Analyze findings to identify vulnerabilities and opportunities to strengthen controls and governance.

Skills

GRC governance

Risk management

Regulatory compliance

Stakeholder engagement

Audit coordination

Education

Bachelor degree in Computer Science / MIS / Information Security

CISSP

CRISC

CISA

CISM

Tools

AWS

Azure

M365

Job description

National Rural Electric Cooperative Association (NRECA) is hiring a Senior Analyst to lead key cybersecurity governance, risk, and compliance (GRC) functions. This role supports risk identification and lifecycle governance, strengthens controls through analysis of findings, and coordinates compliance and issue remediation with regulators and auditors.

Key Responsibilities

• Advise IT and business units by leading activities to identify, assess, and prioritize cybersecurity risks, ensuring alignment with legal, regulatory, contractual, policy, and standard requirements.
• Partner with risk and control owners to develop, implement, and maintain risk registers and metrics; govern and report on risks and mitigations throughout the lifecycle; maintain risk management policies, standards, and the assessment plan.
• Manage compliance and issue management activities, including coordination with regulators and auditors to track and remediate issues.
• Test controls for design and effectiveness and partner with owners to implement remediation; report findings and remediation status.
• Analyze findings to identify vulnerabilities and opportunities to strengthen controls, governance, and mitigation.
• Proactively advise leaders on improvements; ensure risks are properly prioritized and escalated.
• Perform cybersecurity risk governance activities in accordance with the governance framework and report conformance.
• Facilitate monthly security risk meetings to report activities, metrics, risks, and improvement opportunities.
• Optimize the risk governance framework using best practices; guide IT and business stakeholders in implementing governance requirements.
• Lead development of third-party risk management policies and standards; advise on the annual assessment plan and collaborate with stakeholders on third-party assessments and risk management.
• Define risk and control requirements for systems, data, and technology across cloud, on premises, and third-party environments; assess system designs for risks and cybersecurity noncompliance.
• Maintain and expand expertise in GRC trends, technologies, and evolving methods to support organizational alignment with current practices.

Required Qualifications

• Bachelor’s degree in Computer Science, Management Information Systems, Information Security, or a related field.
• 7+ years of experience in IT and information security risk management, compliance, audit, and governance.
• 7+ years of experience leading and conducting information security risk assessments, control audits, and third-party security risk assessments.
• Strong technical knowledge of IT and information security technologies, including AWS, Azure, and M365.
• Experience applying information security frameworks, standards, and best practices, including NIST CSF, NIST RMF, NIST 800-30, NIST 800-53, NIST 800-171, HIPAA, SOC 2, CIS, ISO 27001/27002, and COBIT.
• Experience with GRC tools, including reports and dashboards development and compliance automation.
• Technical knowledge related to security hardening of OS, applications, and networks.
• Experience reviewing system or network designs for risk and compliance across multiple enclaves or networks, including environments with different data protection or classification.
• Conducted third-party security assessments, including reviewing contracts for security requirements and inserting risk management practices into existing processes.
• Led implementation of technical security controls across all phases of the SDLC, ensuring alignment with security architecture standards and compliance requirements.

Preferred Certifications

• Information Systems Security Professional (CISSP)
• Risk and Information Systems Control (CRISC)
• Certified Information Systems Auditor (CISA)
• Certified Information Systems Manager (CISM)

Technologies & Standards

• AWS
• Azure
• M365
• NIST CSF
• NIST RMF
• NIST 800-30
• NIST 800-53
• NIST 800-171
• HIPAA
• SOC2
• CIS
• ISO 27001/27002
• COBIT

Location and Work Arrangement

Arlington, VA (hybrid)

Compensation

Salary: USD 150,000-185,000 per year. Final compensation is determined by individual qualifications, experience, and internal equity.

Education

Bachelor’s degree in Computer Science, Management Information Systems, Information Security, or related field.

Essential Physical Requirements

• Close visual acuity to perform activities such as preparing and analyzing data and figures, transcribing, viewing a computer terminal, and extensive reading.
• May require exerting up to 20 pounds of force occasionally, up to 10 pounds frequently, and/or a negligible amount of force constantly to move objects; classified as light work if sitting most of the time and using arm and/or leg controls requires forces greater than sedentary work.