Governance, Risk and Compliance Analyst III

The Information Security Governance Risk and Compliance (GRC) Analyst
is responsible for ensuring the confidentiality, integrity, and availability of University of Wisconsin Credit Union (UWCU) information by working with a team of GRC analysts who continually assess UWCU's information security posture. This role regularly reviews information security policies, standards, and procedures to ensure UWCU is aligned with industry best practices including applicable laws and regulations. Additionally, this role conducts third-party risk evaluations and assessments to minimize cybersecurity risk exposure and impacts on the business.

The individual in this role supports legal, audit, accounting and loss prevention departments in assessing compliance and works to develop, implement, and maintain a comprehensive information security compliance program that encompasses all aspects of the organization’s information management life cycle. By safeguarding UWCU’s information, you will have the opportunity to make a positive impact on our organization and our members.

Compliance

• Recommend procedures to ensure compliance with relevant laws, regulations, and industry standards.
• Ensure technical controls are effective by coordinating reviews with technical engineers and analysts.
• Continually research and stay up to date on emerging compliance issues.
• Coordinate with stakeholders to ensure policies and standards are communicated effectively, supporting training and awareness initiatives.
• Support audits to assess the effectiveness of security controls and identify compliance gaps, in accordance with legal and regulatory requirements.
• Work with regulatory examiners and auditors as necessary.
• Maintain documentation for internal audits, external audits, and independent third-party assessments.
• Train and educate employees on cybersecurity compliance requirements.

Governance

• Ensure ethics, transparency and accountability in the practice of information security governance.
• Support the policy and standard lifecycle, including creation, review, revision, approval, communication, and retirement.
• Develop and implement robust information security policies and standards that align with industry best practices, security frameworks, and regulatory requirements.
• Conduct policy and standard reviews, ensuring to address emerging threats or changes in the regulatory landscape.
• Coordinate review of policies and procedures with technology engineers ensuring practicality for implementation.
• Identify and resolve conflicting policies.
• Facilitate Information Security Steering Committee (ISSC) meetings, providing insight into the implementation and effectiveness of information security governance.
• Integrate security measures into business processes to ensure that security is considered in all organizational activities.
• Collaborate with cross-functional teams to address security issues and implement corrective measures.

Risk

• Support the Information Security Risk Management Program, planning and coordinating the execution of risk assessments, monitoring emerging risks, and maintaining the risk register.
• Conduct and coordinate regular risk assessments to identify vulnerabilities and potential threats.
• Implement risk mitigation strategies and controls to manage identified risks effectively.
• Support the identification and ranking of third-party cybersecurity risks and impacts.
• Implement communication and escalation plans for third-party cybersecurity risk management activities within the enterprise.
• Evaluate third-party cybersecurity risks as defined in contracts and in accordance with existing risk management programs and policies.
• Develop, monitor, and execute third-party remediation actions, mitigation, and contingency plans when cybersecurity risks or events are identified.
• Evaluate external party compliance with regulatory requirements.
• Support the security onboarding process for new vendors.
• Gather third-party cybersecurity risk assessment data and prepare assessments for critical third parties, to be published and communicated to stakeholders.
• Track identified cybersecurity risks and events.
• Support communication plans to report identified cybersecurity risk requirements and violations to internal stakeholders, end users, and responsible third parties, supporting the response and resolution of these issues.
• Guide third parties and business partnears to ensure compliance with cybersecurity risk management policies.
• Support a monitoring system for third-party…