Cybersecurity Controls Assurance & GRC Automation Analyst

About the Role

Blue Cross and Blue Shield of Nebraska is seeking a cyber/GRC analyst to shape how the organization validates, measures, and strengthens cybersecurity controls across a modern, highly regulated technology environment. The role involves risk‑based control assessments that go beyond checklist compliance, connecting technical security testing with practical risk insight to help prioritize meaningful improvements.

This position is based in Omaha, Nebraska, with remote flexibility allowing 1–2 days per week in the office. Candidates must live within driving distance of the Omaha office or reside in one of the approved states (Florida, Iowa, Kansas, Minnesota, Missouri, Nebraska, North Dakota, Texas) and be able to travel to headquarters as business needs dictate.

Responsibilities

• Perform risk‑based cybersecurity control assessments, evaluating design, implementation, effectiveness, and supporting evidence.
• Utilize emerging automated penetration testing and attack simulation platforms across cloud, identity, endpoint, network, infrastructure, application, vulnerability management, and data‑protection systems.
• Identify misconfigurations, control failures, and assess attack paths, providing practical remediation recommendations.
• Support GRC and continuous‑control‑monitoring capabilities, including automated evidence collection, control testing, remediation tracking, risk management processes, dashboards, metrics, and reporting.
• Partner with cybersecurity, technology, risk, audit, and business teams to investigate issues, support audits and regulatory reviews, and participate in validation activities such as configuration testing, vulnerability validation, attack‑path analysis, and purple‑team exercises.
• Translate technical findings into clear risk insights for both technical and non‑technical stakeholders.
• Contribute to the development and improvement of cyber risk metrics, GRC dashboards, and executive‑ready reporting.
• Leverage automation, scripting, or workflow tools to streamline evidence collection, control testing, and remediation tracking.

Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Risk Management, or a related field, or equivalent experience.
• Three to five years of experience in cybersecurity assurance, security operations, cybersecurity engineering, penetration testing, IT audit, GRC, risk management, or a related discipline.
• Experience performing cybersecurity control testing, technical assessments, configuration reviews, vulnerability validation, or security assessments.
• Working knowledge of cybersecurity frameworks such as NIST, CIS Controls, HITRUST, HIPAA, or ISO 27001.
• Ability to interpret technical evidence and translate cybersecurity findings into practical risk and remediation recommendations.
• Strong communication skills, capable of conveying technical cybersecurity issues clearly to both technical teams and non‑technical stakeholders.

Preferred Qualifications

• Experience with GRC or continuous‑control‑monitoring platforms.
• Hands‑on experience with penetration testing, red/purple teaming, attack‑path analysis, or adversary‑informed testing.
• Knowledge of MITRE ATT&CK and cloud, identity, network, and endpoint security concepts.
• Background in healthcare, financial services, or another highly regulated industry.
• Relevant certifications such as CISSP, CISM, CISA, CRISC, CGRC, Security+, OSCP, or similar.
• Experience developing or improving cyber risk metrics, GRC dashboards, or executive‑ready reporting.
• Comfort using automation, scripting, or workflow tools to streamline evidence collection, control testing, or remediation tracking.

Additional Information

Blue Cross and Blue Shield of Nebraska is an equal opportunity employer that values diversity of experience, perspective, and background. The company does not sponsor employment visas for this position. Reasonable accommodations may be made to enable individuals with disabilities to perform essential functions.