Senior Security Analyst, GRC

Great America Financial Services is a highly successful entrepreneurial company providing equipment financing to businesses across the United States. Our exemplary customer service, our principle-centered business philosophy and our team-based operating approach are key to our success and growth. We are looking to add a Key Member to our Enterprise Security Team! The Senior Security Analyst, GRC supports the bank’s enterprise security governance program, ensuring alignment with regulatory expectations, enterprise risk management, and industry frameworks.

This role oversees security policies, standards, risk governance, partners with third-party security oversight, and provides support for regulatory engagement. The Senior Analyst partners with technology, risk, compliance, and audit teams to strengthen the bank’s Enterprise Security Governance framework and ensures effective operation of the three lines of defense by independently reviewing control effectiveness designed by first-line security engineering and IT operations.

Great America welcomes applications from candidates residing the following states, where we currently support employment and payroll operations:
Arizona, Florida, Georgia, Iowa, Kansas, Michigan, Missouri, Nebraska, South Dakota, Tennessee, Texas, and Wisconsin.

• Security Governance & Policy Support the development and maintenance of the bank’s information security governance framework.
• Track the lifecycle of security policies and standards, reporting non-compliance to the policy owners.
• Ensure alignment with regulatory guidance from the Federal Financial Institutions Examination Council and banking regulators.
• Maintain governance artifacts including policy exception processes and control documentation.
• Independently review first-line procedures for alignment with approved policies and standards.
• Risk & Compliance Oversight (Second Line) Support enterprise risk management by coordinating information security risk assessments.
• Track and manage the security risk register.
• Monitor and independently validate remediation of identified risks and control gaps.
• Independently assess controls built and operated by first-line security engineering and IT operations teams and formally challenge control design, ownership, and evidence sufficiency through the second-line issue and escalation process.
• Regulatory & Audit Management Act as the primary security governance liaison for regulators and auditors.
• Support exams and reviews conducted by applicable agencies.
• Coordinate and support responses to regulatory findings, internal audit issues, and external requests from customers.
• Security Metrics & Reporting Develop and maintain security governance reporting for executive leadership.
• Produce dashboards for:
  Risk posture Policy compliance Control effectiveness Incident trends
• Support the presentation of quarterly updates to risk committees and senior management.
• Framework Alignment & Continuous Improvement Maintain governance alignment with industry frameworks – NIST CSF, NIST RMF, CIS, ITGC
• Recommend and support improvements to governance processes and tooling (Optro/Auditboard)
• Collaborate across legal, compliance, risk, and technology functions

• Bachelor’s degree or equivalent preferred.
• Minimum of 5 years of work experience in information security, risk, security governance or audit.
• Strong knowledge of information security governance, risk management, regulatory compliance, and control frameworks, preferably within banking or regulated financial services.
• Working knowledge of banking regulatory expectations, FFIEC guidance, and recognized security frameworks such as NIST CSF, NIST RMF, CIS, and ITGC.
• Experience supporting regulatory exams, audit reviews, external customer requests, findings, issue management, and remediation tracking.

• ISACA CISA
• ISACA CRISC
• ISC2 CGRC
• ISC2 CISSPISACA CISM

• Exceptional organizational, analytical, and follow-through skills.
• Excellent verbal and written communication skills.

Role will likely include periodic large project-oriented demands with tight…