Security Governance, Risk & Compliance Analyst

Location: New York

At Early Warning, we’ve powered and protected the U.S. financial system for over thirty years with cutting-edge solutions like Zelle, Paze℠, and so much more. As a trusted name in payments, we partner with thousands of institutions to increase access to financial services and protect transactions for hundreds of millions of consumers and small businesses.

Positions located in Scottsdale, San Francisco, Chicago, or New York follow a hybrid work model to allow for a more collaborative working environment.

Candidates responding to this posting must independently possess the eligibility to work in the United States, for any employer, at the date of hire. This position is ineligible for employment Visa sponsorship.

Overall Purpose The Security Governance, Risk & Compliance Analyst conducts comprehensive activities supporting information security governance, risk, and compliance, including but not limited to drafting and updating security policies, standards, and procedures; performing security risk assessment and remediation activities; supporting the internal controls testing program; facilitating audits and assessments; information security issues oversight; supporting security training and awareness activities.

Essential Functions Plan and support the Security Governance, Risk and Compliance programs and department initiatives

Further develop Security Governance, Risk and Compliance skills and support at least two of the functional areas within Security Governance, Risk and Compliance:
Risk management, PCI assessments, Internal Audits, Security policy management, GRC tool management, remediation plans for security-related findings (IA, OCC, SOC-2, etc.), participation and facilitation of external audits: (GLBA, SOC-2, customer audits, consolidated customer audits), Security trainings and user responsibility agreements, ensure adherence to policies and deadlines, and provide assistance to remediation owners for interpretation of policies and processes in line with the objectives of the organization and regulators.

Provide consultation to management on regulatory, legal, and contractual requirements.

Perform GRC activities using the GRC platform; support the Security Department with GRC platform usage and best-practices.

Engage business owners throughout the organization in the development and enforcement of security policies, standards, procedures, and guidelines at the direction of Security Management.

Oversee the completion of internal control testing; advise management on control design and implementation; perform testing where needed.

Identify control gaps and weaknesses, and track and report remediation progress.

Assess information security risk and recommend mitigation activities in alignment with Enterprise and Operational Risk Management requirements.

Facilitate the collection and review of documentation required for internal and external audits and assessments (SOC-2, GLBA, FISMA, PCI-DSS, others).Facilitate the execution of internal and external audits and assessments.

Conduct security GRC reporting (risk, controls, issues, or otherwise) for management and stakeholders.

Create monthly security-focused metrics reporting for management and senior leadership.

Maintain compliance programs (security awareness and training activities, phishing and password, etc.) according to their set schedules.

Support the company’s commitment to protect the integrity and confidentiality of systems and data.

The above job description is not intended to be an all-inclusive list of duties and standards of the position. Incumbents will follow instructions and perform other related duties as assigned by their supervisor.

Minimum Qualifications Education and experience typically obtained through completion of a bachelor’s degree.

Minimum 2 years direct/ related work experience in security, governance, risk, and compliance, risk management, IT audit, information technology, or related.

Excellent written/verbal communication skills, with ability to present to peers and co-workers

Working knowledge of common security frameworks such as: HITRUST, ISO 27001, NIST, PCI-DSS or SOC Background and drug screen.

Preferred Qualifications Addi…