Senior Analyst, Cyber Governance, Risk and Compliance (GRC)

About the role

The Senior Cyber Governance, Risk, and Compliance (GRC) Analyst is a key member of the Cyber GRC team and the broader Information Security organization. This full-time role is responsible for supporting and advancing the organization’s cybersecurity governance, risk management, and compliance initiatives. The Senior Analyst works closely with cross-functional teams to help ensure that cybersecurity risks are identified, assessed, and managed in alignment with business objectives, regulatory requirements, and industry best practices. This role is designed for experienced professionals who are passionate about cybersecurity risk management and committed to strengthening enterprise security programs. The Senior Cyber GRC Analyst contributes to the development, implementation, and continuous improvement of governance processes, compliance activities, and cyber risk management practices that support an effective and resilient Information Security program. A critical expectation of this role is a strong sense of ownership, dedication, commitment, and accountability. The Senior Analyst is expected to take responsibility for assigned workstreams and deliverables from initiation through completion, proactively manage deadlines and dependencies, maintain clear and timely communication with stakeholders, and appropriately escalate risks, blockers, or delays. The successful candidate will demonstrate consistent follow-through and accountability for the quality, timeliness, and completion of their work. In this position, the Senior Analyst will collaborate with stakeholders across technology, risk, and business teams to support security assessments, policy and control development, regulatory and framework alignment, and risk remediation efforts. This role provides the opportunity to influence and enhance the organization’s security posture while working alongside experienced cybersecurity leaders and practitioners. Through these responsibilities, the Senior Cyber GRC Analyst plays an important role in helping the organization maintain a strong cybersecurity governance structure and ensuring that the Information Security program effectively addresses evolving threats, regulatory expectations, and business priorities.

Responsibilities

• Support the firm’s Cyber Governance, Risk, and Compliance (GRC) program by evaluating and enhancing security controls, policies, standards, procedures, and guidelines in alignment with the organization’s reference security framework.
• Support the alignment of the firm’s Information Security Program with recognized security frameworks and regulatory expectations (e.g., NIST CSF, ISO 27001, CIS Controls, and applicable financial regulatory requirements) by mapping controls, identifying gaps, and recommending improvements.
• Contribute to the ongoing development and maintenance of cybersecurity policies, standards, and governance documentation, ensuring they remain aligned with evolving threats, regulatory requirements, and industry best practices.
• Provide support for internal and external audits by coordinating documentation requests, collecting control evidence, and ensuring timely delivery of required artifacts.
• Participate in the execution of recurring GRC program activities, including quarterly access reviews, control validation activities, and other governance processes that support compliance and risk oversight.
• Conduct and support the firm’s Third-Party Risk Management (TPRM) activities by performing vendor risk assessments, evaluating security documentation, and producing risk evaluations for both new and existing third-party vendors.
• Identify, assess, and track cybersecurity risks affecting the firm and its third