Senior GRC Analyst

We take great strides to ensure our employees have the resources to live well, be healthy, continue learning, develop skills, grow professionally and serve our local communities. We invite you to apply for a career with us.

Residency in or relocation to Louisiana is preferred for all positions.

Leads the validation, assessment, and authorization processes necessary to assure that existing and new information technology (IT) systems meet the organization's cybersecurity and risk requirements.

• Bachelor's in IT, Audit, and/or related fields required
• Four years of related experience can be used in lieu of a Bachelor’s degree.

• 4 years of relevant, specialized experience and highly developed proficiency within multiple disciplines including Governance, Risk, and Compliance required

• This position does not have any direct reports but is expected to mentor and lead the operational activities of junior team members.
• Requires excellent analytical, critical thinking, communication, marketing, and consulting skills.
• Hands‑on technical expertise in cybersecurity, IT infrastructure (networking, server management, etc.), cloud technologies, or application development is highly desirable.
• Works under minimal supervision with latitude for independent judgment in a remote environment. Conducts tasks and assignments as directed or independently.

• Technology Risk Management
• Governance Documentation Management (i.e. Policies, Processes, and Procedures)
• Cybersecurity Awareness and Training
• Management of IT/Security Controls & Ensuring Compliance with Legal and Regulatory Requirements
• Auditing (Preferably IT Audit)
• Technical Management of IT Infrastructure (e.g. networking, server administration, cloud technologies, etc.)
• Cybersecurity Architecture, Incident, and Response

• Multiple Cybersecurity, IT or Security Governance, Information Systems Audit, Compliance, Risk Management, or computer networking trainings and certifications are preferred (e.g. CISA, CRISC, CGEIT, CISM, CISSP, CompTIA Sec+, CIA, CRMA, COSO/ERM, etc., or other relevant certifications from reputable organizations such as GIAC, ISC2, ISACA, or Comp TIA).

• Collaborates and consults with a team of Cybersecurity and IT professionals to accomplish multiple of the following objectives as determined by management.

• Collaborates on the development and implementation of the annual strategic plan
• Develops Board‑level reporting
• Maintains and ensures integration with the company’s cybersecurity, control, and risk management frameworks
• Manages and maintains a functional, accessible, and protected control library and facilitates reviews with control owners
• Tracks pertinent laws and regulations and maps relationships between various legal, regulatory, and contractual requirements (HIPAA, SOC‑2, SOC‑1, AFRMR, etc.) and various security cybersecurity and control frameworks (NIST CSF, NIST 800‑53, COBIT, etc.)
• Leads in the design of security controls to ensure alignment with the organization’s risk appetite and tolerance levels to support business objectives
• Develops and maintains IT and Cybersecurity governance documentation assets including charters, policies, standards, processes, procedures, and artifacts
• Ensures alignment of controls with all supporting governance documentation
• Facilitates the identification of metrics and key performance indicators to enable the measurement of security controls performance in meeting business objectives
• Trains and promotes awareness to the workforce on cybersecurity responsibilities and protections through phishing simulations, remote awareness events, computer‑based trainings, and frequent communications
• Develops, maintains, and reports on operational governance metrics

• Maintains risk alignment to the company’s chosen cybersecurity framework
• Assesses BCBSLA’s technical environment for alignment to the chosen Cybersecurity Framework and develops remediation efforts to close gaps and mature the cybersecurity control…