Lead execution of GRC program initiatives, contributing design input on processes, workflows, and work products as the program matures toward enterprise tooling adoption.
Maintain and operationalize risk registers, control frameworks, and maturity assessments aligned to NIST CSF 2.0, HIPAA/HITECH, and applicable federal and state security and privacy regulations.
Drive compliance monitoring activities and recommend updates to security policies, standards, and procedures that balance regulatory rigor with operational practicality.
Coordinate the third-party risk management process, including vendor risk assessments and ongoing vendor risk workflows.
Apply risk scoring methodologies to support framework maturity tracking and quantified risk metrics, incorporating business continuity and disaster recovery considerations.
Manage structured GRC work products in spreadsheet and document-based environments (e.g., Excel, SharePoint), keeping them accurate, accessible, and audit-ready on an ongoing basis.
Translate technical findings into clear, actionable written and verbal reporting for executive and non-technical audiences.
Partner with stakeholders across IT and non-IT business functions to advance new standards and workflows, influencing adoption without direct authority.
Prioritize multiple concurrent workstreams to deliver accurate results on schedule in a fast-paced, evolving environment.

Bachelor's degree in Cybersecurity, Computer Science, Information Management, or a related field preferred
A minimum of six years of experience in information security or related discipline, with a strong focus on governance, risk, and compliance programs in complex or regulated environments.
Demonstrated experience building or significantly maturing a GRC function, including the design of processes and workflows prior to enterprise tooling adoption.
Professional certifications such as CISA, CRISC, CISSP, or equivalent are highly desirable.
Demonstrated experience in data mining, analysis and report development required.
Strong knowledge of information systems security concepts and current information security/privacy trends and practices.
Knowledge of Federal and State security and privacy-related regulatory requirements.
Must be able to prepare formal reports and presentations as needed.
Knowledge about medical records and other medical information, patient privacy and confidentiality, and release of information.

Senior Cybersecurity Analyst, GRC

Key skills