Governance, Risk & Compliance Analyst

As a GRC Analyst, you’ll test security controls, assess risk and compliance, report findings to stakeholders, and maintain information security policies and standards.

You’ll participate in information security risk management by testing the effectiveness of security controls, assessing security controls and compliance for suppliers, systems, and processes against threats and industry best practices to confirm adherence to security and compliance requirements. You’ll report findings and recommendations to information security management and business stakeholders to ensure any concerns are resolved. You’ll also review and maintain ongoing governance of the organization’s information security policies and standards.

This position will be located at our Office in Stevens Point, WI in a hybrid work model and is not a fully remote opportunity.

Sentry does not offer employment in this position to holders of F-1, J-1, and H-1 Visas for the purpose of obtaining practical experience.

As an Information Security GRC Analyst, you will:

• Design, implement, and maintain the IS governance framework, ensuring alignment with corporate governance and regulatory requirements.
• Establish and oversee IT and IS control objectives and approve the design and methodology used for control effectiveness testing.
• Create, update, and manage the review lifecycle of security policies, standards, and procedures to ensure compliance with governance frameworks.
• Validate the design and integrity of the control effectiveness testing program, ensuring methodologies are sound, identifying testing gaps, and monitoring remediation efforts.
• Define, monitor, and report Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) related to overall control effectiveness, risk mitigations, and governance maturity.
• Validate the end-to-end process for reviewing and approving security exception requests, ensuring proper documentation and process adherence.
• Define the strategic direction and selection criteria for GRC platforms, and lead research into GRC tooling optimization.
• Coordinate internal and external audit alignment for governance-related areas (e.g., framework design, governance metrics creation and reporting, control objective definition).
• Contribute to the definition and communication of Sentry’s information security risk appetite, collaborating with executive leadership.
• Review and understand fundamental regulations and frameworks related to cybersecurity.

Additionally, you will:

• Periodically review and enhance governance methodologies and drive improvements to mature the IS governance program.
• Collaborate on the research and development of security initiatives and deliver strategic governance recommendations to management.
• Perform other job-related duties as assigned from time to time.

• Bachelor’s degree or equivalent work experience
• Minimum 2 years of related work experience in information security, internal audit, security risk management or related field
• Successfully completed or able to work towards a security certification (e.g., CISA, CRISC, CISSP, PCI ISA, Security+, etc.) preferred.
• Demonstrated experience in information security policy development, management, or framework design.
• Experience with control design, control effectiveness testing methodologies, or audit coordination.
• Strong analytical skills with an ability to define and track metrics (KPIs/KRIs).
• Proven ability to facilitate cross-functional processes and drive documentation.

At Sentry, your total rewards go beyond competitive compensation. We’re committed to supporting the whole you, which is why we offer a comprehensive package designed to help you thrive both professionally and…