Security Analyst, Governance Risk Compliance

Location: Remote from an approved city and state; company location listed as Tempe, Arizona, United States.

Company

hirify.global Family of Brands operates used car sales, financing, servicing, and vehicle protection businesses through hirify.global, Bridgecrest, and SilverRock.

What you will do

• Lead information security risk assessments and cyber risk management activities, including identification, analysis, scoring, treatment planning, documentation, tracking, and reporting.
• Perform compliance monitoring and control assessments against policies, standards, frameworks, contracts, and regulatory requirements.
• Lead policy governance, audit support, third-party security assessments, due diligence, and security awareness initiatives.
• Develop risk statements, treatment recommendations, reports, process improvements, methodologies, procedures, and performance metrics.
• Coordinate audit evidence collection, remediation tracking, security questionnaires, insurance inquiries, and external security assessments.
• Provide subject matter expertise, stakeholder guidance, and mentorship to less-experienced analysts.

Requirements

• 4+ years of experience in Information Security GRC, cybersecurity risk management, IT compliance, IT audit, security assurance, or a related discipline.
• Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Business, Risk Management, Audit, or a related field.
• Demonstrated experience independently conducting risk assessments, evaluating controls, documenting findings, and developing remediation or risk treatment recommendations.
• Experience supporting and improving GRC processes, methodologies, workflows, and enabling technologies.
• Familiarity with the NIST Cybersecurity Framework and information security risk and control concepts.
• Strong understanding of cybersecurity risk management, governance principles, security controls, and compliance assessment methodologies.
• Ability to translate technical security findings into clear business risks and actionable recommendations, facilitate discussions, and present complex information to technical and non-technical audiences.
• Strong analytical, critical-thinking, problem-solving, organizational, communication, collaboration, and attention-to-detail skills, with the ability to manage multiple projects and deadlines.
• Ability to partner with Information Security, Technology, Legal, Compliance, Internal Audit, Vendor Management, and business teams; take ownership of programs and process improvements; and mentor others.

Nice to have

• Experience with NIST 800-53, PCI DSS, SOC reporting, GLBA/FTC Safeguards Rule, or state privacy and security regulations.
• Professional certifications such as CISSP, CISA, CRISC, Security+, or similar cybersecurity, risk, or audit credentials.
• Experience with third-party risk management, security awareness programs, privacy initiatives, technology audits, or related cybersecurity domains.
• Experience supporting audit and compliance programs in highly regulated environments.
• Exposure to security governance, policy management, and enterprise risk reporting.

Culture & Benefits

• Work from a home office in an approved city and state with reliable, secure internet and a quiet workspace.
• Medical, dental, and vision insurance, company-paid life insurance, short- and long-term disability coverage, and a 401(k).
• Paid time off for full-time employees, including wellness days and holidays.
• Tuition reimbursement, professional growth opportunities, and a wellness program with coaching, incentives, and medical-premium discounts.
• Background and drug screening are required; the workplace is drug-free, tobacco-free, and an equal opportunity workplace.