GRC Analyst
-
IT/Tech
Cybersecurity, Information Security & Data Protection, Security Management & Operations
Job Description & How to Apply Below
Hayward Holdings Inc. (NYSE "HAYW") is one of the leading manufacturers of residential swimming pool equipment in the world, with a significant presence in the commercial pool market that is continuously growing. Hayward designs, manufactures, and markets a full line of residential and commercial pool and spa equipment including pumps, filters, heating, cleaners, salt chlorinators, automation, lighting, safety, flow control and energy solutions at our company owned facilities.
Headquartered in Charlotte, North Carolina, Hayward also has facilities in Tennessee, Arizona, and Rhode Island, Georgia, as well as Canada, Spain, France, Australia, and China.
Data Loss Prevention/Governance, Risk Management, & Data Security
Location:
Clemmons, NC
Reports To:
Director, Global Information Security
The Senior Cybersecurity Risk & Governance Analyst supports the organization’s cybersecurity governance, risk, compliance, identity governance, and data protection programs. This role serves as a subject matter expert for IT controls supporting SOX and Internal Controls over Financial Reporting (ICFR), including control assessment, audit support, risk identification, and remediation.
The Senior Analyst also supports cybersecurity risk assessments, policy and standards development, access governance, third-party risk, and alignment with frameworks including NIST CSF, NIST SP 800-53, ISO 27001, and CIS Controls.
The role provides governance and operational support for Varonis and SailPoint, partnering with Information Security, IT, Finance, Internal Audit, external auditors, application owners, and business stakeholders to identify and mitigate cybersecurity and compliance risks.
Key Responsibilities Cybersecurity Governance & Risk Management- Perform cybersecurity risk assessments across applications, infrastructure, cloud services, and technology initiatives.
- Maintain cybersecurity risk registers, remediation plans, control exceptions, and risk treatment activities.
- Map security controls to NIST, ISO 27001, CIS, SOX, and applicable regulatory requirements.
- Develop GRC metrics, KRIs, KPIs, and management reporting to communicate cybersecurity risk and compliance posture.
- Identify opportunities to automate and mature GRC processes.
- Support the design, documentation, testing, and operation of IT General Controls (ITGCs) supporting SOX and ICFR.
- Execute and assess controls covering logical access, privileged access, change management, system operations, and data integrity.
- Assess control effectiveness, identify deficiencies, perform root-cause analysis, and coordinate remediation.
- Produce complete, defensible audit evidence and maintain control narratives, Risk and Control Matrices (RCMs), and testing documentation.
- Serve as a key liaison with Internal Audit, external auditors, control owners, and IT leadership.
- Identify opportunities for control automation and improved audit efficiency.
- Administer Varonis capabilities supporting sensitive-data discovery, classification, monitoring, and access governance.
- Identify excessive or inappropriate access to sensitive, financial, confidential, and regulated information.
- Partner with data owners to remediate inappropriate permissions and strengthen least-privilege access.
- Develop reports, dashboards, alerts, and audit evidence related to data security and access.
- Support investigations involving sensitive-data exposure and inappropriate access.
- Perform and oversee SOX-related User Access Reviews (UARs) and periodic access certifications.
- Validate provisioning, modification, termination, privileged access, and segregation-of-duties controls.
- Support enhancement of the SailPoint environment, including application onboarding, entitlement aggregation, role modeling, access certifications, and lifecycle processes.
- Assist with development of Role-Based Access Control (RBAC) models, access profiles, and entitlement structures.
- Identify opportunities to automate access governance and improve oversight of privileged and high-risk accounts.
- Coordinate IT and cybersecurity activities supporting internal and external audits.
- Manage cybersecurity and control findings through remediation and closure.
- Support security assessments of vendors, technology providers, and cloud services.
- Review SOC 1/SOC 2 reports, ISO 27001 certifications, security…
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).