Cybersecurity Analyst - Governance Risk Compliance; GRC)

Position: Cybersecurity Analyst - Governance Risk Compliance (GRC)
Zions Bancorporation is transforming what it means to work for a financial institution. With a commitment to technology and innovation, we have been providing our community, clients, and colleagues with the best experience possible for over 150 years. Help us transform our workforce of the future, today.

We are currently looking for a Cybersecurity Analyst - Governance Risk Compliance (GRC) to join Zions Bancorporation's Enterprise Information Security team to drive our enterprise-wide Cybersecurity Awareness culture. You will reduce human risk by designing engaging security education, managing threat simulations, and championing proactive security behaviors across the organization.

Responsibilities

Training & Education

• Design, coordinate, and execute security awareness training that is both precise and entertaining while effectively reducing behavior risk.
• Curate and tailor security training for specific audiences, such as our Information Security teams, developers, system administrators, people leaders, and executive leadership.
• Understand adult learning theory with ability to simplify complex subjects into easy-to-understand material with a focus on visual aids.
• Maintain relevant cybersecurity knowledge and collaborate with cyber threat intel and incident response partners for understanding and inclusion of real and emerging threats as part of delivering relevant simulation exercises.
• Analyze simulation results to identify high-risk user groups and individuals.
• Recommend and develop "just-in-time" learning content

Culture & Communication Campaigns

• Maintain existing Cybersecurity Awareness intranet site and use it to distribute cybersecurity communications, articles, and curated content explaining security best practices in simple, non-technical language.
• Act as a security advocate, fostering a supportive, "no-blame" reporting culture where employees feel comfortable reporting security concerns.
• Act as a voice for the Cybersecurity team, reviewing and editing departmental and company communications.
• Facilitate and participate in Cybersecurity Ambassadors with representatives across the organization, creating a bridge between business units and cybersecurity.

Metrics, Analytics, and Reporting

• Recommend and understand Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) to measure the effectiveness of the training and awareness program beyond training completion metrics.
• Use behavioral data to continuously refine and adapt the training strategy.
• Other duties as assigned.

Qualifications

Education & Experience

• Education:
  
  Bachelor's degree in computer science, Information Technology, Cybersecurity, Communications, Human Resources, Instructional Design (other degrees will be considered), or a related field; or equivalent practical experience.

• Experience:
  
  2-4 years of experience in information security, training development, corporate communications, or instructional design (preferably within an IT or cybersecurity context).

Skills & Knowledge

• Project Management:
  Strong organizational skills with the ability to manage multiple campaigns and projects simultaneously.

• Creativity & Innovation:
  Always looking for fun, memorable, and novel ways to keep security top-of-mind.

• Analytical Mindset:
  Uses data and metrics to guide decisions and improve training efforts over time.

• Collaboration:
  
  Able to build strong relationships across Information Security teams, Risk Management, HR, Corporate Communications, and IT.

• Risk Management:
  
  Basic understanding of risk management disciplines.

• Security Principles:
  Basic understanding of core cybersecurity concepts, threats (phishing, social engineering, malware), and standard security controls.

• Instructional Design & Content Creation:
  Knowledge of adult learning theory and experience creating engaging digital content.

• Communication:
  Exceptional written and verbal communication skills. Ability to translate complex, highly technical concepts into engaging, easy-to-understand language for a non-technical audience.

Plus

• Certifications such as, but not limited to:
  Security Awareness Practitioner (CSAP) or SANS Security Awareness Professional (SSAP) or CompTIA Security+ Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM) or ISC2 CC

• Understanding of banking industry including laws and regulations

Visa Sponsorship

This Cybersecurity Analyst position is currently NOT eligible for employment visa sponsorship (e.g., H-1B visa). This includes, for example, situations where a candidate may have temporary work authorization while enrolled in school or upon graduation (e.g., CPT, OPT) but would need H-1B visa sponsorship within a few years of employment in order to maintain employment eligibility.

Location

This position has a hybrid work from home schedule with a minimum of three days per week in the office at the new Zions Technology Center in Midvale, UT.

The Zions Technology Center is a 400,000-square-foot technology campus in Midvale, Utah. Located on the former…