[Hiring] Senior Analyst, Governance Risk Compliance @DriveTime

Role Description

In short, you’ll serve as a senior-level technical risk leader within the Information Security Governance, Risk & Compliance (GRC) function. In this role, you'll independently lead complex cybersecurity risk assessments across applications, infrastructure, cloud environments, identity platforms, data protection controls, and business processes. You'll help strengthen and mature the organization's risk management program by developing standardized assessment methodologies, guiding risk treatment decisions, supporting compliance and audit initiatives, leading third-party assessments, and mentoring other GRC professionals. This position requires a strong blend of technical cybersecurity knowledge, business risk acumen, and the ability to influence stakeholders across the organization.

In Long, as the Senior GRC Analyst, you will be responsible for:

• Leading complex Information Security risk assessments across applications, infrastructure, cloud, identity, data, and business processes, including threat identification, control evaluation, likelihood and impact analysis, risk scoring, treatment planning, documentation, tracking, and reporting.
• Developing, standardizing, and enhancing cybersecurity risk assessment methodologies, control evaluation frameworks, documentation standards, risk scoring models, and management reporting processes.
• Leading assigned GRC services and initiatives including compliance monitoring, policy governance, audit support, third-party security assessments, due diligence activities, and related risk management processes.
• Providing technical risk management leadership, subject matter expertise, quality reviews, process improvement recommendations, and mentorship to other analysts.
• Independently assessing technical security findings, vulnerabilities, and compensating controls to develop clear risk statements and actionable treatment recommendations.
• Evaluating business impacts, identifying material cybersecurity risks, and preparing risk acceptance or remediation recommendations for management decision-making.
• Conducting control assessments against applicable policies, standards, regulatory obligations, contractual requirements, and industry frameworks while tracking remediation and recurring issues.
• Leading third-party cybersecurity assessments and partnering with Vendor Management, Legal, Compliance, Technology, and business stakeholders to identify and address security risks.
• Coordinating and developing responses to cybersecurity due diligence questionnaires, customer security reviews, external assessments, insurance inquiries, and related requests.
• Supporting and improving Information Security policy governance through drafting, reviewing, updating, and maintaining policies, standards, and related documentation.
• Owning or supporting Information Security awareness and education initiatives, including communications, training content, campaign development, program metrics, and continuous improvement efforts.
• Serving as the primary owner for assigned GRC services and risk management processes by establishing procedures, metrics, governance routines, and accountability frameworks.
• Mentoring GRC Analysts and promoting consistent, high-quality risk assessment and reporting practices throughout the organization.
• Performing other duties as assigned.

Qualifications

• Strong technical understanding of cybersecurity threats, vulnerabilities, attack vectors, and security controls across identity, network, endpoint, application, cloud, and data security domains.
• Ability to independently assess technical risks, identify control gaps, evaluate compensating controls, and determine practical risk treatment strategies.
• Strong analytical and critical thinking skills with the ability to challenge assumptions, prioritize risks, and make sound risk-based recommendations.
• Exceptional written and verbal communication skills with the ability to translate complex technical risks into business-focused recommendations.
• Strong organizational and project management skills with the ability to manage multiple concurrent initiatives and assessments.
• Ability to influence and collaborate effectively with technical and non-technical stakeholders without direct authority.
• Demonstrated ability to improve processes, methodologies, reporting capabilities, and governance practices.
• Strong attention to detail and commitment to producing high-quality risk assessments, documentation, and reporting.
• Ability to mentor and develop less experienced team members while fostering collaboration and continuous improvement.
• Comfortable navigating ambiguity and driving results in a dynamic, evolving cybersecurity environment.

Requirements

• 7+ years of relevant experience in Information Security, cybersecurity risk management, security engineering, security architecture, IT risk, IT audit, or a related discipline.
• 3+ years of experience independently leading technical cybersecurity risk assessments.
• Demonstrated experience assessing applications, infrastructure, cloud environments, identity solutions, or other technical systems and evaluating associated security controls and threat scenarios.
• Experience developing risk statements, conducting control assessments, and delivering actionable risk treatment recommendations.
• Experience establishing, enhancing, or maturing cybersecurity risk assessment methodologies, documentation practices, scoring models, governance routines, or reporting frameworks.
• Strong knowledge of the NIST Cybersecurity Framework (CSF).
• Familiarity with NIST SP 800-30, NIST SP 800-53, or similar cybersecurity risk assessment and control frameworks.
• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Computer Science, Risk Management, or a related field.

Benefits

• Work From Home.
• Medical, dental, and vision coverage.
• 401(K), Company paid life insurance policy, short and long-term disability coverage.
• Growth Opportunities.
• Tuition Reimbursement.
• Wellness Program.
• Competitive pay.
• Paid Time Off including wellness days, holidays, and vacation time.