Cyber Security Governance, Risk, and Compliance; GRC Analyst

Governance, Risk, and Compliance (GrC) Analyst

The Governance, Risk & Assurance (GRA) Analyst is responsible for evaluating the security posture of software applications, vendors, and third-party technologies to support the organization's cyber risk management program. This role focuses on performing detailed software security assessments, managing third-party cyber risk reviews, and ensuring that technology solutions entering the environment meet required security and compliance standards. The analyst conducts thorough evaluations of vendor security practices, analyzes application and infrastructure risks, collaborates with internal stakeholders across Enterprise Technology (ET) and business units, and provides clear recommendations to reduce cyber exposure.

This position requires strong analytical capabilities, high attention to detail, and the ability to interpret complex cybersecurity information to support reliable and secure technology operations.

Key Responsibilities:

• Perform detailed security assessments for new and existing software, including evaluation of architecture, data handling, authentication, logging, and vulnerability posture.
• Lead third-party cyber risk reviews, including analysis of vendor security questionnaires, vulnerability disclosures, and evidence of security controls.
• Identify and document cybersecurity risks, mitigation steps, and recommendations in alignment with enterprise risk and third party cyber risk management processes.
• Collaborate with cyber security, network, server, and application teams to validate security requirements and ensure proper integration of software and vendor solutions.
• Assist in maintaining security artifacts such as risk registers, assessment documentation, and approval workflows for software and vendor evaluations.
• Monitor changes in cyber threats and emerging risks that may impact software or third-party environments.
• Support continuous improvement of risk assessment processes, tools, and communication workflows across the GRA function.

Education, Training and

Experience:

• Technical Analyst:
  Bachelor's degree in Computer Science, Information Technology, or a related field (OR) Associate degree and a minimum of three (3) years technical IT experience, including specific experience as listed below (OR) High school diploma/GED and a minimum of five (5) years technical IT experience, including specific experience as listed below.
• Systems Analyst:
  Bachelor's degree in Computer Science, Information Technology, or a related field and a minimum of four (4) years technical IT experience as listed below (OR) Associate degree and a minimum of six (6) years technical IT experience including specific experience as listed below (OR) a high school diploma/GED and a minimum of eight (8) years technical IT experience including specific experience as listed below.
• Senior Systems Analyst:
  Bachelor's degree in Computer Science, Information Technology, or a related field and a minimum of eight (8) years technical IT experience as listed below (OR) Associate degree and a minimum of ten (10) years technical IT experience including specific experience as listed below (OR) a high school diploma/GED and a minimum of twelve (12) years technical IT experience including specific experience as listed below.

Experience:

• Ability to work independently and in cooperation with others on multiple activities with flexibility to manage competing demands and changing priorities.
• Excellent communication, interpersonal, and organizational skills.
• Excellent analytical problem-solving skills.
• Must be customer-service oriented and adaptable to ongoing change.

Ideal Technical

Skills:

• Strong attention to detail and the ability to analyze complex technical information with precision.
• Foundational understanding of cybersecurity concepts, including vulnerabilities, secure design principles, and common control frameworks.
• Working knowledge of network architecture and design principles, including segmentation, protocols, and data flow analysis.
• Experience working in both IT and OT environments, with awareness of unique risks and constraints in operational/industrial systems.
• Ability to read, interpret, and assess vendor documentation such as SOC 2, penetration test reports, security whitepapers, and architecture diagrams.
• Familiarity with third-party cyber risk management practices, vendor security questionnaires, and risk scoring methodologies.
• Understanding of secure software lifecycle practices and typical application security requirements.
• Strong written and verbal communication skills to clearly articulate risks, controls, and recommendations to technical and non-technical audiences.

Licenses and/or

Certifications:

• Security Clearance:
  Incumbent may be required to satisfy any existing and future District security clearance or background check requirements for access to key NPPD locations and/or supporting sensitive business applications.
• Obtain and maintain intermediate to advanced technical certification aligned with key…