Information Security GRC Analyst - Sugar Land or Lubbock

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Full Time Analyst LUBBOCK ANNEX, Lubbock, TX, US

POSITION PURPOSE

The Information Security Governance, Risk, and Compliance (IS GRC) Analyst is responsible for supporting the execution of the Bank's Information Security Governance, Risk, and Compliance program. This role performs and supports information security governance, cyber risk management, policy and standards administration, regulatory compliance, third-party cybersecurity risk management, control framework activities, audit and examination support, risk exception processes, remediation tracking, and security metrics and reporting.

Working closely with the IS GRC Manager, Lead IS GRC Analyst, Enterprise Risk Management (ERM), Information Technology (IT), Vendor Management (VM), Human Resources (HR), Internal Audit (IA), Legal, Compliance, Procurement, and business stakeholders, the IS GRC Analyst supports the implementation, administration, and continuous improvement of information security governance processes and controls. The role assists with security risk assessments, control evaluations, third-party cybersecurity risk management activities, audit and examination support, risk exception administration, remediation tracking, and security reporting while helping ensure alignment with applicable laws, regulations, industry frameworks, and organizational requirements.

This position reports directly to the IS GRC Manager.

ESSENTIAL FUNCTIONS AND BASIC DUTIES

• Support day-to-day execution of the Bank's IS GRC program and related governance, risk, compliance, and reporting activities.
• Assist with the administration and maintenance of Information Security policies, standards, procedures, control documentation, and governance processes.
• Conduct and document information security risk assessments, control evaluations, and risk analyses for technology solutions, business initiatives, third parties, and other assigned activities.
• Support the Information Security risk register by documenting identified risks, remediation activities, treatment decisions, status updates, and supporting evidence.
• Support the Security Exception and Risk Acceptance process by collecting information, documenting compensating controls, tracking mitigation activities, and preparing management reporting.
• Support Information Security compliance and control framework activities, including assessments and reporting related to the CRI Profile, NIST CSF, NIST Special Publications, CIS Critical Security Controls, FFIEC guidance, and other applicable standards.
• Support internal audits, external audits, regulatory examinations, independent assessments, and control reviews by gathering evidence, preparing documentation, tracking responses, and monitoring remediation activities.
• Conduct third-party cybersecurity risk management activities, including cybersecurity due diligence reviews, inherent risk assessments, assurance evidence reviews, issue tracking, and ongoing monitoring.
• Analyze cybersecurity, GRC, risk, control, and third-party risk data to identify trends, control weaknesses, concentrations, emerging risks, and opportunities for program improvement.
• Assist with the development and reporting of KRIs, KPIs, security metrics, dashboards, and management reports.
• Monitor emerging cybersecurity threats, regulatory developments, control framework changes, and industry practices and elevate relevant observations as appropriate.
• Communicate security risks, control issues, findings, recommendations, and status updates clearly to technical and non-technical stakeholders.
• Build and maintain effective working relationships with Information Technology, Enterprise Risk Management, Vendor Management, Compliance, Legal, Procurement, Internal Audit, and business stakeholders.

The above statements describe the general nature and level of work only. They are not an exhaustive list of all required responsibilities, duties, and skills. Other duties may be added, or this job description may be amended at any time.

SUPERVISORY RESPONSIBILITIES:

This position does not have direct supervisory responsibilities.

QUALIFICATIONS

Education/Certification: Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, a related discipline, or the equivalent of combined education and related work experience.

Professional…