Senior IT Governance, Risk, and Compliance (GRC) Analyst

About the role

Are you ready to transform lives through academic excellence, innovative research, strong community partnerships and economic opportunity? Kennesaw State University is one of the 50 largest public institutions in the country. With growing enrollment and global reach, we continue to expand our institutional influence and prominence beyond the state of Georgia. We offer more than 190 undergraduate, graduate, and doctoral degrees to empower over 50,000 students to become thought leaders, lifelong learners, and informed global citizens. Our entrepreneurial spirit, high-impact research, and Division I athletics draw students from throughout the region and from more than 100 countries across the globe. Our university's vibrant culture, career opportunities, rich benefits, and values of respect, integrity, collaboration, inclusivity, and accountability make us an employer of choice. We are part of the University System of Georgia. We are searching for talented people to join Kennesaw State University in our vision. Come Take Flight at KSU!

Our Kennesaw campus is located at 1000 Chastain Road NW, Kennesaw, GA 30144. Our Marietta campus is located at 1100 South Marietta Parkway, Marietta, GA 30060.

The position leads enterprise cybersecurity governance, risk management, compliance, and third-party risk activities while supporting alignment with institutional, state, and federal requirements. This position serves as a senior subject matter expert, providing strategic guidance, leading complex assessments, and promoting risk-informed decision-making across the university.

Responsibilities

• Leads enterprise IT and cybersecurity risk assessments using NIST, CIS, and institutional frameworks, evaluating compensating controls and contextual risk to support informed decision-making.
• Maintains and enhances the enterprise IT risk register, ensuring accurate risk documentation, ownership assignment, remediation tracking, and risk acceptance processes.
• Leads third-party vendor risk assessments, analyzing SOC reports, HECVATs, security questionnaires, and supporting documentation to evaluate organizational risk.
• Coordinates audit readiness activities, evidence collection, stakeholder engagement, response tracking, and remediation efforts related to cybersecurity and regulatory audits.
• Assesses and validates technical, administrative, and operational controls against GLBA, HIPAA, FERPA, PCI-DSS, NIST, and related compliance requirements.
• Supports the University's data privacy program, including Records of Processing Activities (RoPA), data privacy consultations and assessments, data privacy requests, privacy risk identification and mitigation, and the development and implementation of data privacy awareness and training initiatives.
• Develops, reviews, and maintains cybersecurity policies, standards, procedures, and governance documentation to support compliance and operational maturity.
• Collaborates with internal stakeholders to evaluate, validate, and reassess IT controls, identify control gaps and risks, and support the development and implementation of appropriate remediation strategies.
• Collaborates with the Office of Research, faculty, and other key stakeholders to support the governance, compliance, risk management, and security and privacy