{"id":3314655,"url":"https://alion.io/job/nreca-sr-analyst-grc-cybersecurity","title":"Sr Analyst GRC Cybersecurity","company":{"id":4253,"name":"NRECA","domain":"electric.coop","url":"https://alion.io/company/nreca","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Arlington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":150000,"max":185000,"currency":"USD","period":"year","gross":null,"usd_annual":185000},"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"HIPAA","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST 800-171","optional":false},{"name":"NIST 800-53","optional":false},{"name":"NIST CSF","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-10-26T00:00:00Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-11-01T13:08:20Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"Job Description\nNRECA is a unique national trade association providing advocacy, financial services and business support services to over 900 consumer owned electric cooperatives across the country. NRECA employees are united by our mission, inclusive culture, collaborative workplace and commitment to service excellence. As a “best place to work” employer, we operate with integrity, transparency and a spirit of innovation.\nJoin IT at NRECA where we are more than a team, we are a community. Guided by the core tenets of Simplicity, Security, Continuity, Transparency, and Flexibility, we strive to deliver business value through collaboration, ideation, and innovation. Become an integral part of a community driven to continuously improve our processes and transform how we work - in partnership with our colleagues and in service to our members.\nThis position leads key functions within Cybersecurity Governance, Risk, and Compliance, including cybersecurity risk identification, assessment, prioritization, and lifecycle governance, as well as compliance and issue management. The ideal candidate will have experience analyzing findings to strengthen controls, improve governance processes, and advise IT and business stakeholders on mitigation strategies. This position is eligible for NRECA’s hybrid schedule which allows for flexibility to work from home up to 2 days per/week.\nKey Responsibilities\nAdvises IT and business units by leading activities to identify, assess, and prioritize cybersecurity risks, ensuring alignment with legal, regulatory, contractual, policy, and standard requirements.\nPartners with risk and control owners to develop, implement, and maintain risk registers and metrics; governs and reports on risks and mitigations throughout the lifecycle; maintains risk management policies, standards, and the assessment plan.\nManages compliance and issue management activities, coordinating with regulators and auditors to track and remediate issues. Tests controls for design and effectiveness and partners with owners to implement remediation, reporting on findings and status.\nAnalyzes findings to identify vulnerabilities and opportunities to strengthen controls, governance, and mitigation. Proactively advises leaders on improvements and ensures proper prioritization and escalation of risks.\nPerforms cybersecurity risk governance, ensuring activities follow the governance framework and reporting on conformance.\nFacilitates monthly security risk meetings to report activities, metrics, risks, and improvement opportunities.\nOptimizes the risk governance framework based on best practices and guides IT and business stakeholders in implementing governance requirements.\nLeads development of third-party risk management policies and standards and advises on the annual assessment plan; works closely with stakeholders on third party assessments and risk management. -party risk management policies and standards and party assessments and risk management.\nDefines risk and control requirements for systems, data, and technology across cloud, on premises, and third-party environments; assesses system designs for risks and cybersecurity noncompliance. -premises, and third-party environments; assesses system designs for risks and cybersecurity non-compliance.\nMaintains and continually develops expertise in GRC trends, technologies, and evolving methods to ensure organizational alignment with current practices.\nQualifications\nRequired Qualifications and Skills\nBachelor’s in Computer Science, Management Information Systems, Information Security, or related field.\n7+ years of experience in IT and information security risk management, compliance, audit, and governance.\n7+ years of experience leading and conducting information security risk assessments, control audits, and third-party security risk assessments.\nStrong technical knowledge of IT and information security technologies, including AWS, Azure, and M365.\nExperience with information security frameworks, standards, and best practices such as NIST CSF, NIST RMF, NIST 800-30, NIST 800-53, NIST 800-171, HIPAA, SOC2, CIS, ISO 27001/27002, and COBIT.\nExperience with GRC tools, reports and dashboards development, and compliance automation.\nPreferred Qualifications and Skills\nTechnical knowledge pertaining to security hardening of OS, applications and networks\nExperience reviewing system or network designs for risk and compliance that encompass multiple enclaves/networks, including those with different data protection or classification.\nConducted Third-Party Security assessments reviewing contracts for security requirements and inserting risk management practices within existing processes.\nLed the implementation of technical security controls across all phases of the SDLC, ensuring alignment with security architecture standards and compliance requirements.\n Preferred Certifications:Information Systems Security Professional (CISSP)\nRisk and Information Systems Control (CRISC)\nCertified Information Systems Auditor (CISA)\nCertified Information Systems Manager (CISM)\n\nEssential Physical Requirements\nThe worker is required to have close visual acuity to perform an activity such as: preparing and analyzing data and figures; transcribing; viewing a computer terminal and extensive reading.\nundefined\nExerting up to 20 pounds of force occasionally, and/or up to 10 pounds of force frequently, and/or a negligible amount of force constantly to move objects. If the use of arm and/or leg controls requires exertion of forces greater than that for sedentary work and the worker sits most of the time, the job is rated for light work.\nSalary Range: $150,000-$185,000 annual salary\nFinal compensation determined by individual qualifications, experience, and internal equity.\nDisclaimer Statemen t: The preceding job description has been written to reflect management’s assignment of essential functions. It does not prescribe or restrict the tasks that may be assigned.\nAdditional Requirement:\nThe preceding job description has been written to reflect management’s assignment of essential functions. It does not prescribe or restrict the tasks that may be assigned. All qualified applicants will receive consideration for employment without regard to race, color, sex, sexual orientation, gender identity, religion, national origin, disability, veteran status, or other legally protected status.\nNRECA is committed to working with and providing reasonable accommodation to individuals with physical and mental disabilities. If you need special assistance or an accommodation while seeking employment, please e-mail  or call: 703-907-5992 - NRECA Arlington Human Resources. Please call 402-483-9275 - NRECA Lincoln Human Resources, for Lincoln, NE employment opportunities. We will make a determination on your request for reasonable accommodation on a case-by-case basis.\nThe U.S. Equal Employment Opportunity Commission (EEOC) recently released the 'Know Your Rights ' poster, which updates and replaces the previous \"EEO is the Law\" poster and \"EEO Is the Law Poster Supplement\".\nPay Transparency Non-Discrimination. NRECA will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay. Please see the Pay Transparency Nondiscrimination Provision for more information.\nE-Verify. As a Federal Contractor, NRECA is required to participate in the E-Verify Program to confirm eligibility to work in the United States. For information please click on the following link: E-Verify.\nFor more information about life at NRECA please visit www.Electric.coop.","description_format":"text","description_chars":7677,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Power Grid","Standards & Industry Bodies"],"lifecycle":[{"event":"open","at":"2026-10-27T04:41:29Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":6,"expected_fill_days":43,"reasons":["conf:5","win:early"],"computed_at":"2026-11-01T06:10:25Z"},"pay":{"stated_usd_annual":185000,"is_top_pay":true},"html_url":"https://alion.io/job/nreca-sr-analyst-grc-cybersecurity","json_url":"https://alion.io/job/nreca-sr-analyst-grc-cybersecurity.json","meta":{"generated_at":"2026-11-01T21:39:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":33014,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4253},"rest":"https://alion.io/mcp/rest/get_company?id=4253"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnreca-sr-analyst-grc-cybersecurity"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnreca-sr-analyst-grc-cybersecurity"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnreca-sr-analyst-grc-cybersecurity"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nreca-sr-analyst-grc-cybersecurity\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnreca-sr-analyst-grc-cybersecurity"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3314655}},{"tool":"search_jobs","arguments":{"company":"electric.coop","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3314655},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}