IT GRC Analyst II

If you are motivated and believe in the credit union philosophy of "People Helping People," join our team! The IT GRC Analyst 2 will assess, test, document, and monitor SECU’s technology ecosystem to ensure the IT control environment effectively mitigates risks associated with an ever changing threat landscape.

• 20% Identify, document, and monitor technology risks present across both internal and external environments (vendor / cloud).
• 20% Quantify inherent and residual IT risk levels to enhance analytics, inform prioritizations, and support management reporting.
• 20% Work with risk remediation owners to establish remediation plans with milestones and target dates, monitor progress, and escalates as appropriate.
• 20% Execute technology risk management processes and provide input to support continuous improvement of process and program design.
• 10% Perform risk and controls assessments while aggregating reporting for audit and/or regulatory issues.
• 10% Partner with relevant stakeholders to establish clear and consistent IT risk reporting, metrics, KRIs, and KPIs to inform decision making.

• 5+ years’ experience in IT security and/or IT risk management in a mid-to-large sized company.
• Teamwork, collaboration, self‑driven attitude, and effective communication skills (written and verbal).
• Basic proficiency or ability to learn one or more of the following:
  • Risk and controls assessments
  • Documenting and maintaining IT policies / standards
  • IT risk aggregation, reporting, KPI/KRIs
  • Issues management
  • Third‑party risk management
• Working knowledge of industry security standards and frameworks including NIST, ISO
  27001, ISF Standard of Good Practice (SoGP), etc.

• Knowledge of modern enterprise and security architectures, their challenges, and related mitigation approaches.
• Professional certifications such as CISSP, CISA, CISM, GIAC, CGEIT, CRISC, OSCE, or other relevant industry certification.
• Experience working in a financial institution.
• Experience working within a Dev Ops environment.

SECU provides equal employment opportunity to all qualified persons regardless of race, color, religion, age, sex, sexual orientation, gender identity, national origin, genetic information, disability, veteran status, or other classification protected by law.