Information Security Analyst II; GRC

Job Details

• Level: Experienced
• Location:
  
  BROOMFIELD, CO 80021
• Position Type:
  Full Time
• Education Level: 4 Year Degree
• Salary Range: $78,068.04 - $97,585.05
• Travel Percentage:
  Negligible
• Job Shift: Day
• Job Category:
  Banking

• Comprehensive medical insurance plan
• Dental and vision insurance
• Generous paid‑time‑off
• 12 paid holidays
• Annual discretionary bonus based on achievement of organizational scorecard results
• 401(k) plan
• Wellness program
• Tuition assistance
• Employee loan discount
• Employee Assistance Program (EAP)
• Life and disability coverage

• Career development and pathing opportunities to move into leadership roles or other lines of business within MCU such as Commercial Lending, Finance, Marketing, Underwriting, Member Solutions, Training, Human Resources, and more
• Supportive and engaging work environment
• A wellness and sustainable work culture that puts family, our community, and your health first
• Work environment that encourages personal as much as professional growth, teamwork to make the dream work, and treating everyone equally
• We are most interested in finding the best candidate, and encourage applications even if you do not meet every qualification listed

This is a full‑time position working 40 hours a week, Monday‑Friday 8:00am – 5:00pm.

Responsible for executing the Governance, Risk, and Compliance (GRC) program within Information Security team for Meritrust Credit Union (MCU). The position reports to the AVP, Security Analysis. The role works closely with the Risk and Compliance department to ensure MCU meets regulatory requirements and organizational risk tolerance. This position maintains all operational tasks within the information security portfolio including security training, building and reviewing security policies and controls, conducting risk reviews of systems and ensuring compliance with information security best practices.

• Stay current with Financial Regulations such as FFIEC guidelines, NCUA requirements, and other compliance regulations
• Familiar with Information Security Frameworks such as PCI DSS, NIST=800-53, FedRAMP, ISO=27001, CIS, MITRE&ATTCK, OWASP Top 10, etc.
• Build and integrate the security frameworks into the MCU Information Security Program, ensuring organizational compliance
• Develop, implement, and maintain policies, standards, and procedures to ensure alignment with MCU security objectives and industry best practices
• Design and conduct employee training on compliance, information security, and risk management topics with a focus on safeguarding MCU assets, including member data

• Perform risk assessments to identify and mitigate risks related to member data, application security, and security tool health checks
• Analyze and document identified risks, providing actionable mitigation recommendations
• Support the Information Security Incident Response Plan (ISIRP), Business Continuity and Disaster Recovery (BC/DR) plans and assist tabletop exercises to ensure operational resilience

• Monitor and support compliance efforts related to regulations and frameworks such as NCUA, NIST, ISO, PCI DSS, CIS, MITRE&ATTCK, OWASP Top 10, and other relevant frameworks
• Assist with internal and external audits and regulatory examinations, providing required evidence and ensuring timely remediation of findings
• Conduct regular testing of controls in security policies to ensure effectiveness and alignment with regulatory requirements
• Manage findings from audits, risk assessments, security policies control testing, documenting resolutions and tracking remediation progress
• Participate in the exceptions management process, conducting documentation, risk acceptance, and periodic reviews of exceptions
• Monitor phishing reports and Info Sec tickets submitted by employees, ensuring proper investigation, resolution, and follow-up

• Collaborate with IT, compliance/risk management, and operational teams to align cybersecurity objectives with MCU security goals
• Provide regular reporting to leadership on the cybersecurity program status, compliance gaps, and risk trends specific to the credit union…