GRC Analyst

The Opportunity

The GRC (Governance, Risk, and Compliance) Analyst  plays an important role in the GRC delivery framework, ensuring Black & Veatch’s compliance with regulatory and contractual requirements, assisting with third-party risk management, and promoting a culture of risk awareness across the enterprise among other responsibilities. With an emphasis on cyber and compliance risk management, the ideal candidate should be able to contribute to measuring success, identifying improvement opportunities and carrying out actions to implement those improvements and mature controls.

This role is ideal for a detail-oriented and self-driven professional with a passion for cyber and compliance risk management.

Key Responsibilities

Cyber Risk Management

• Collaborate with peer D&IT groups to collect KPI’s, KRI’s and drive efficiency through automation and other means
• Support establishment, collection, and ongoing improvement of metrics to measure effectiveness of cyber risk management and provide data-driven insight to decision makers and control owners

Compliance Risk Management

• Monitor regulatory and legal landscape at a global scale and maintain awareness of compliance requirements
• Review and monitor compliance to client contractual requirements related to data security, risk management/cyber resilience, and breach reporting
• Request and review documentation and evidence from control owners to certify and validate compliance to regulatory requirements
• Support independent certification and audit by working with D&IT peer groups and lines of business to collect documentation and evidence

IT Governance

• Contribute to policy development aligned with regulatory and contractual requirements
• Maintain and assist updating standards of practice documentation to be referenced by architecture and operations teams
• Participate in regularly scheduled governance forums and contribute process knowledge

Supplier/Third Party Risk Management

• Actively participate in third party risk assessment process including reviewing input from third parties and offering opinion of risk factors 
• Assist review of client security requirements in contracts and aggregate relevant clauses to inform contractual risk

Miscellaneous:

• Leverage tools, including GenAI in a secure manner to gain efficiencies in delivery of functions
• Assist in conducting user training in SETA tool + help establish and optimize metrics and feedback with business stakeholders
• Support internal audit 
• Assist with security certification/attestations/audits to demonstrate control effectiveness to independent service auditors/assessors and C3PAO’s
• Assist in development of risk mitigation plans and monitoring progress of actions.
• Collaborate with members of the GRC team to ensure timely and quality deliverables to internal and external consumers
• Organize, prioritize, and with input from team members, respond to incoming GRC related requests from IT and other business units

Management Responsibilities

Minimum Qualifications

• Bachelor’s degree in Information Systems, Computer Science or a related field, or relevant years of experience to substitute for a degree.  
• 2–3 years of experience in a GRC role
• All applicants must be able to complete pre-employment onboarding requirements (if selected) which may include any/all of the following: criminal/civil background check, drug screen, and motor vehicle records search, in compliance with any applicable laws and regulations.

Preferred Qualifications

• Strong analytical, organizational, and communication skills
• Professional certifications such as CRISC, CISSP or others
• Exposure to and knowledge of privacy laws
• Experience with GRC platforms and risk management methodologies
• Ability to work independently and collaboratively as required+ Accountability in projects and tasks, following through to completion with minimum supervision
• Strong collaboration with IT teams
• Familiarity with regulatory frameworks and best practices (e.g., NIST, ISO 27001, CIS CISC, UK Cyber Essentials, CMMC, SCF)
• Proficiency in information security principles and concepts
• Attention to detail and critical thinking
• Ethical judgment and integrity
• Ability to manage multiple tasks and deadlines
• Strong interpersonal and stakeholder engagement skills

Work Environment/Physical Demands

Hybrid or flexible work options may be offered after the first 90 days of employment based upon manager discretion, job performance and work assignments.

Salary Plan

Job Grade