Governance, Risk & Compliance Analyst

As a GRC Analyst, you'll test security controls, assess risk and compliance, report findings to stakeholders, and maintain information security policies and standards.

You’ll participate in information security risk management by testing the effectiveness of security controls, assessing security controls and compliance for suppliers, systems, and processes against threats and industry best practices to confirm adherence to security and compliance requirements. You’ll report findings and recommendations to information security management and business stakeholders to ensure any concerns are resolved. You’ll also review and maintain ongoing governance of the organization's information security policies and standards.

This position will be located at our Office in Stevens Point, WI in a hybrid work model and is not a fully remote opportunity.

Sentry does not offer employment in this position to holders of F-1, J-1, and H-1 Visas for the purpose of obtaining practical experience.

As a Governance, Risk & Compliance Analyst, you will:

• Conduct security risk assessments to identify concerns and ensure compliance with Sentry's security documents by gathering data, analyzing effectiveness of controls, collaborating with internal and external parties, and evaluating risk magnitude.
• Perform security testing using GRC platforms and other analysis tools to evaluate the design and effectiveness of key controls.
• Support our business and legal counsel in negotiating contracts that protect security and privacy.
• Provide documentation and recommendations to Information Security, Information Technology, and/or business stakeholders to ensure audit results, risk findings, and action items are understood. Track remediation of identified security and compliance gaps to ensure corrections are implemented and sustainable.
• Study emerging security trends, issues, and regulations to understand the impact on the information security program. Participate in ongoing governance of the information security policies and standards to ensure associates are complying with documented security requirements and applicable laws.
• Coordinate the review and approval of security exception requests to document practices that differ from information security policies, standards, and requirements due to business or technological constraints.
• Review and understand fundamental regulations and frameworks related to cybersecurity.

Additionally, you will:

• Study emerging security trends, issues, and regulations to understand their impact on the information security program.
• Participate in the research and development of security initiatives and provide risk management recommendations to leadership.
• Assist with the administration of IS Risk platforms used in performing risk activities.
• Perform other job-related duties as assigned from time to time.

• Bachelor's degree or equivalent work experience
• Minimum 2 years of related work experience in information security, internal audit, security risk management or related field
• Successfully completed or able to work towards a security certification (e.g., CISA, CRISC, CISSP, PCI ISA, Security+, etc.) preferred.
• Demonstrated experience in conducting information security risk assessments and managing risk registers preferred.
• Strong understanding of third-party risk management principles and processes preferred.
• Experience with risk treatment planning and monitoring preferred.
• Proven ability to manage meetings for senior management (e.g., ISRC) preferred.

At Sentry, your total rewards go beyond competitive compensation. We're committed to supporting the whole you, which is why we offer a comprehensive package designed to help you thrive…