Senior Analyst, GRC

DriveTime

. Lead Information Security risk assessments and cyber risk management activities, including identification, analysis, scoring, treatment planning, documentation, tracking, and reporting .

Posted 10/13/2026full-timeRemote • Arizona • United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Information Security GRC, including risk assessments, compliance monitoring, and policy governance. Capable of translating technical findings into actionable business recommendations while fostering collaboration across various teams.

Highest-signal resume keywords

Information Security GRCCybersecurity Risk ManagementNIST Cybersecurity FrameworkRisk Assessment and Control EvaluationCompliance Assessment Methodologies

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Risk AssessmentCompliance MonitoringPolicy GovernanceAudit SupportSecurity Awareness ProgramsControl Effectiveness EvaluationRemediation RecommendationsGRC Process ImprovementCybersecurity AssessmentsDocumentation and Reporting

Soft Skills

Analytical SkillsCritical ThinkingProblem-SolvingCommunication AbilitiesOrganizational Skills

Industry Keywords

CybersecurityIT ComplianceSecurity AssuranceRisk ManagementVendor Management

Tech Stack

Tools & technologies

Cyber Security

About the role

Key responsibilities & impact

Lead Information Security risk assessments and cyber risk management activities, including identification, analysis, scoring, treatment planning, documentation, tracking, and reporting
Perform Information Security compliance monitoring and control assessments against policies, standards, frameworks, contractual obligations, and regulatory requirements
Lead GRC services including policy governance, audit support, third-party security assessments, due diligence, and security awareness programs
Provide subject matter expertise, risk guidance, reporting, process improvement recommendations, and mentorship within the GRC function
Facilitate risk assessments and evaluate control effectiveness across technology and business environments
Develop risk statements and risk treatment recommendations for management review and decision-making
Support internal and external audits by coordinating evidence collection, interpreting requests, and tracking remediation
Conduct cybersecurity assessments of third-party vendors and collaborate with business partners to address risks
Coordinate responses to security due diligence questionnaires, insurance inquiries, and external security assessments
Manage the Information Security policy lifecycle, including drafting, reviewing, updating, approval tracking, and periodic reviews
Support and enhance security awareness and education initiatives through communications, campaigns, training content, and reporting
Maintain GRC processes, procedures, methodologies, and performance metrics and identify continuous improvement opportunities
Guide and mentor less-experienced analysts and promote consistent GRC practices
Perform other duties as assigned

Requirements

What you’ll need

4+ years of experience in Information Security GRC, cybersecurity risk management, IT compliance, IT audit, security assurance, or a related discipline
Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Business, Risk Management, Audit, or a related field, or an equivalent combination of education and experience
Demonstrated experience independently conducting risk assessments, evaluating controls, documenting findings, and developing remediation or risk treatment recommendations
Experience supporting and improving GRC processes, methodologies, workflows, and enabling technologies
Familiarity with the NIST Cybersecurity Framework (CSF) and Information Security risk and control concepts
Strong understanding of cybersecurity risk management, governance principles, security controls, and compliance assessment methodologies
Ability to translate technical security findings into clear business risks and actionable recommendations
Strong analytical, critical-thinking, and problem-solving skills
Excellent written and verbal communication abilities
Ability to facilitate discussions and present complex information to technical and non-technical audiences
Strong organizational skills and ability to prioritize multiple projects and deadlines
Ability to build partnerships across Information Security, Technology, Legal, Compliance, Internal Audit, Vendor Management, and business teams
Ability to take ownership of programs, services, and process improvements
Strong attention to detail and commitment to continuous learning
Hiring contingent upon successful completion of background and drug screening
Must work from an approved city and state with a conducive, quiet workspace and reliable, secure internet

Benefits

Comp & perks

Work from home from an approved city and state
Medical, dental, and vision insurance with employer-covered premiums
401(k)
Company-paid life insurance
Short- and long-term disability coverage
Professional growth opportunities
Tuition reimbursement
Wellness program with self-guided coaching, journeys, cash incentives, and medical premium discounts
Competitive pay
Paid time off, including wellness days, holidays, and vacation time