GRC Analyst (Governance) (R26_0000028922)

Under general supervision, the Governance, Risk & Compliance (GRC) Analyst II supports the company's GRC functions, which may include Privacy, Compliance, Risk Management, Third-Party Risk, Governance, or Attack Surface Management. This role executes day-to-day GRC activities within the assigned domain and reports to the GRC Lead.

• Monitor vulnerability scanning results and maintain visibility into the external attack surface.
• Track and prioritize vulnerabilities for remediation, partnering with IT Operations and Application Development.
• Own vulnerability management reporting and metrics and scanning tool administration.
• Drive remediation SLAs and escalate cross-team blockers as needed.
• Develop, maintain, and periodically review information security policies and standards.
• Own the IT Security Awareness program, including content updates and tracking stakeholder participation.
• Manage policy exceptions and the exception/acceptance process.
• Represent Governance in cross-team initiatives and audits.
• Support compliance activities across pertinent platforms.
• Support Operational Technology (OT) compliance efforts with the Cyber Defense Engineering & Architecture team.
• Manage privacy notices, cookie compliance, and consent/preference management across digital properties.
• Support privacy program operations, including gap identification and remediation tracking.
• Assist with Privacy Impact Assessments (PIAs) and Data Privacy Impact Assessments (DPIAs).
• Manage intake and processing of Data Subject Access Requests (DSARs).
• Assist with compliance audits and assessments, including evidence coordination.
• Produce privacy and compliance metrics and reporting for the Lead, and support privacy training and awareness content.
• Maintain the cyber risk register and track security issues through the remediation lifecycle, following up with control owners.
• Support IT risk assessments and third-party/vendor risk assessments, including periodic reviews and QA of risk documentation.
• Track and communicate risk exceptions and remediation action plans to stakeholders.
• Collaborate with business partners and vendors to improve risk processes.
• Maintain awareness of relevant risk frameworks and standards.

• Bachelor's degree in computer science, software engineering, or a related field and three to five years of related experience, or equivalent combination.

• Strong analytical, organizational, and documentation skills.
• Excellent written and verbal communication skills.
• Ability to work independently in a lean team environment.
• Detail-oriented and self-directed.
• Relevant certification or progress toward certification.
• Familiarity with GRC tooling/platforms.
• Experience in a specific framework relevant to the assigned functional area.