Cybersecurity Governance, Risk, and Compliance (GRC) Analyst

• The Cybersecurity Governance, Risk, and Compliance ( GRC ) Analyst supports the University’s information security governance, risk management, compliance, and cybersecurity awareness programs. The position collaborates with academic and administrative departments, Information Technology, external auditors, and third-party vendors to identify and assess cybersecurity risks, evaluate control effectiveness, support regulatory compliance, and promote sound information security practices across the University. The GRC Analyst serves as a key liaison between technical and non-technical stakeholders and helps ensure alignment between cybersecurity activities, institutional objectives, risk management priorities, regulatory obligations, and recognized industry frameworks. The University’s cybersecurity program is aligned with the NIST Cybersecurity Framework ( CSF ) 2.0, and this position supports continued maturity across the Govern, Identify, Protect, Detect, Respond, and Recover functions.

Required

• Bachelor’s degree in Cybersecurity, Information Systems, Risk Management, Business Administration, or related field, or equivalent combination of education and experience. Three (3) years of progressively responsible experience in cybersecurity, compliance, auditing, risk management, information technology, or related disciplines. Experience conducting risk assessments, compliance reviews, audits, or policy-related activities. Understanding of cybersecurity controls, governance practices, and risk management principles. Knowledge of cybersecurity governance, risk, compliance, and audit principles. Ability to analyze risks and develop practical recommendations. Ability to interpret regulatory and compliance requirements. Strong analytical and critical-thinking skills. Excellent written, verbal, and presentation skills. Ability to effectively communicate cybersecurity risks to technical and non-technical audiences. Strong organizational skills and attention to detail. Ability to manage multiple projects and priorities simultaneously. Ability to maintain confidentiality and exercise sound judgment.

Preferred

• Experience in higher education or another regulated environment. Familiarity with NIST Cybersecurity Framework ( CSF ), NIST 800-53, NIST 800-171, CIS Controls, ISO 27001, or related frameworks. Experience with FERPA , GLBA , PCI - DSS , and privacy regulations. Experience supporting third-party risk management and cybersecurity audits. Security+, CISA , CRISC , CGRC , CISSP , CySA+, or related certifications.