Analyst-Cyber GRC, Sr

Analyst-Cyber GRC, Sr. (Finance)

• The Information Technology Governance, Risk, and Compliance (GRC) team supports Tallgrass's cybersecurity risk and compliance program across the enterprise. This includes cyber risk management, policy and standards governance, third-party risk management, contractual cybersecurity review, compliance monitoring, control assessments, security awareness, and audit readiness.
• The Senior Analyst, Cyber GRC supports the continued improvement of Tallgrass Energy's cybersecurity posture by assessing risk, evaluating controls, supporting compliance obligations, and recommending practical safeguards to reduce risk. This role serves as a key advisor to business and technology stakeholders and helps ensure cybersecurity requirements are understood, documented, and implemented effectively.
• This position also serves as the security function's primary reviewer of incoming contractual cybersecurity language and works closely with Legal, Supply Chain/Sourcing, IT, Security Operations, Engineering, and business stakeholders on contract reviews, obligation mapping, risk assessments, issue management, and control governance.

• The Information Technology Governance, Risk, and Compliance (GRC) team supports Tallgrass's cybersecurity risk and compliance program across the enterprise. This includes cyber risk management, policy and standards governance, third-party risk management, contractual cybersecurity review, compliance monitoring, control assessments, security awareness, and audit readiness.
• The Senior Analyst, Cyber GRC supports the continued improvement of Tallgrass Energy's cybersecurity posture by assessing risk, evaluating controls, supporting compliance obligations, and recommending practical safeguards to reduce risk. This role serves as a key advisor to business and technology stakeholders and helps ensure cybersecurity requirements are understood, documented, and implemented effectively.
• This position also serves as the security function's primary reviewer of incoming contractual cybersecurity language and works closely with Legal, Supply Chain/Sourcing, IT, Security Operations, Engineering, and business stakeholders on contract reviews, obligation mapping, risk assessments, issue management, and control governance.

• Bachelor's degree from an accredited college or university.
• Minimum of five years of experience in cybersecurity, information security, risk management, risk assurance, compliance, third-party risk management, audit, or a related field may be considered as a substitute for a degree.

• Experience conducting or supporting risk assessments, control evaluations, compliance assessments, vulnerability assessments, and audit readiness activities.
• Experience reviewing cybersecurity, privacy, compliance, or risk-related contract language.
• Experience mapping contractual, regulatory, customer, or internal requirements to cybersecurity frameworks, policies, standards, controls, and evidence.
• Experience supporting third-party/vendor risk management, including vendor due diligence, security assessments, remediation tracking, and ongoing monitoring.
• Experience reviewing vendor security documentation, such as SOC 1/SOC 2 reports, ISO certifications, security questionnaires, policies, control attestations, or penetration test summaries.
• Proficiency with risk assessment methodologies, tools, and techniques.
• Strong understanding of cybersecurity controls, risk management, business continuity, disaster recovery, control ownership, and exception governance.
• Familiarity with GRC tools, third-party risk management platforms, or similar systems.
• Understanding of cybersecurity frameworks, standards, and best practices, such as NIST Cybersecurity Framework, NIST SP 800-53, ISO 27001, SOC 2 Trust Services Criteria, TSA Security Directives, and applicable privacy requirements.
• Ability to communicate governance, risk, compliance, and audit concepts effectively to technical teams, business stakeholders, and executives.

• Must possess and maintain a valid driver's license and a driving record satisfactory to the company and its insurers (for travel).

• Strong written and verbal communication skills, including the ability to explain technical or control requirements to non-technical stakeholders.
• Ability to organize competing priorities, meet deadlines, and maintain accurate documentation.
• Sound judgment, accountability, and professionalism when handling sensitive company information.
• Ability to work collaboratively across functional boundaries and influence outcomes without relying solely on reporting authority.
• Strong analytical, research, interviewing, negotiation, and evidence-management skills.
• Ability to apply a risk-based approach to determine the appropriate depth of review.

• All the physical requirements listed below are those that may be necessary for an employee to…