risk and compliance analyst

Morningstar

<p></p><div><p><b>The Group:</b>
</p><p>The Information Security department is responsible for setting enterprise security policies and standards that are designed to protect the confidentiality, integrity and availability of Morningstar information. The security team offers guidance and technical expertise in areas like application security, policies and procedures, disaster recovery and compliance/regulation. We analyze emerging security threats and conduct risk and vulnerability assessments to ensure that our information remains secure.</p><p></p><p><b><br>
The Role:</b>
</p><p>The Information Security Team is looking for a Senior Analyst Third-Party Vendor Risk Analyst to join the IT Compliance Team. The Senior Third-Party Vendor Risk Analyst will help shape the Information Security Team&rsquo;s third party vendor risk management program. This individual will serve as a subject matter expert for third party vendor risk management, perform vendor risk assessments, propose updates to expand the program&rsquo;s capabilities, increase participation in the program and drive process improvements. This position is based in either our Chicago or Toronto office.</p><p></p><p><b><br>
Responsibilities:</b></p><ul><li><p>
Partner with the business to execute vendor risk assessments</p></li><li><p>
Monitor internal SLAs to ensure we provide timely service to our internal stakeholders
</p></li><li><p>Serve as a subject matter expert for security vendor risk management</p></li><li><p>
Collaborate with the procurement department and other internal stakeholders to improve and expand the vendor risk management program</p></li><li><p>
Review third party security documents (SOC2, security policies, data flow diagrams, etc.)</p></li><li><p>
Perform contract reviews of proposed changes to security requirements in our third party contracts</p></li><li><p>
Liaise with third party vendors as required</p></li></ul><p><br>
</p><p><b>Requirements:</b></p><ul><li><p>
A bachelor&rsquo;s degree and 5+ years&rsquo; experience include 3+ in a vendor risk related role</p></li><li><p>
Experience serving as the subject matter expert for security vendor due diligence
</p></li><li><p>Experience performing contract review of security terms</p></li><li><p>
Familiarity with common compliance standards (SOX, SOC2, PCI-DSS, GDPR etc.)</p></li><li><p>
Familiarity with security frameworks (ISO 27001, NIST, etc.) and general security concepts</p></li><li><p>
Strong organizational skills and the ability to multitask and switch priorities with short notice</p></li><li><p>
Strong business analysis, research and analytical skills</p></li><li><p>
Excellent communication skills</p></li></ul><p></p><p><b>
Compensation and Benefits</b></p><p>
At Morningstar we believe people are at their best when they are at their healthiest. That&rsquo;s why we champion your wellness through a wide range of programs that support all stages of your personal and professional life. Here are some examples of the offerings we provide:</p><ul><li><p>
Financial Health</p><ul><li><p>
100% 401k match up to 6% of salary</p></li></ul><ul><li><p>
Stock Ownership Potential</p></li><li><p>
Company provided life insurance - 1x salary + commission</p></li></ul></li><li><p>
Physical Health</p><ul><li><p>
Comprehensive health benefits (medical/dental/vision) including potential premium discounts and company-provided HSA contributions (up to $500-$2,000 annually) for specific plans and coverages</p></li><li><p>
Additional medical Wellness Incentives - up to $300-$600 annual</p></li><li><p>
Company-provided long- and short-term disability insurance</p></li></ul></li><li><p>
Emotional Health</p><ul><li><p>
Trust-Based Time Off</p></li><li><p>
6-week Paid Sabbatical Program</p></li><li><p>
6-Week Paid Family Caregiving Leave</p></li><li><p>
Competitive 8-24 Week Paid Parental Leave</p></li><li><p>
Adoption Assistance</p></li><li><p>
Leadership Coaching &amp; Formal Mentorship Opportunities</p></li><li><p>
Annual Flex Stipend - $1000 annually to cover personal education &amp; well-being expenses
</p></li><li><p>Tuition Reimbursement</p></li></ul></li><li><p>
Social Health</p><ul><li><p>
Charitable Matching Gifts program</p></li><li><p>
Dollars for Doers volunteer program</p></li><li><p>
Paid volunteering days</p></li><li><p>
15+ Employee Resource &amp; Affinity Groups</p></li></ul></li></ul><p></p><p><b>
Total Cash Compensation Range</b></p>
$114,100.00 - 193,975.00 USD Annual<p><b>
Inclusive of annual base salary and target incentive</b></p><p>
Morningstar's hybrid work environment gives you the opportunity to collaborate in-person each week as we've found that we're at our best when we're purposely together on a regular basis. In most of our locations, our hybrid work model is four days in-office each week. A range of other benefits are also available to enhance flexibility as needs change. No matter where you are, you'll have tools and resources to engage meaningfully with your global colleagues.</p><p></p>
001_MstarInc Morningstar Inc. Legal Entity</div>

Senior IT Risk and Compliance Analyst

The Church of Jesus Christ of Latter-day Saints

<div><p>The Information Security Risk and Compliance Analyst 2 is an entry 2 level professional position that works on assignment with clear instruction and supervision from leaders to leverage available tools and processes in the defense of applications, systems and networks. This position may also be assigned to help document and implement controls and practices that meet the Church&rsquo;s defined policies and standards for risk and compliance.
</p><p>This individual works with divine guidance to provide or support technology that furthers the mission of the Church and reflects the eternal impact of the gospel.
</p><p>We value early, mid and late-career candidates and encourage all applicants with the posted skills and abilities to apply.</p></div>
<br><div><p>As assigned, assist with the remediation of vulnerabilities and threats
</p><p>Assist in additional discovery and investigation under the direction of incident responders and/or security managers
</p><p>Review documentation and reports to identify gaps, vulnerabilities, and issues to be escalated for further evaluation
</p><p>Assist in the investigation and analysis of technology audit recommendations
</p><p>Assist in the clarification and documentation of identified problems for future recognition and remediation
</p><p>Knowledgeable and current in information security practices, trends and technologies</p></div>
<br><div><ul><li>Bachelor&rsquo;s degree in related field or equivalent professional experience
</li><li>One year of experience in security, privacy, business continuity, or compliance
<br>
<ul><li>Knowledge of security risk and/or compliance assessment
</li></ul></li><li>Good interpersonal and collaborative skills with ability to work effectively as part of a team
</li><li>Professional written and oral communication skills
</li><li>Detail-oriented with the proven ability to follow instructions
</li><li>Works well with others, especially those in complementary roles
</li><li>Ability to monitor and analyze operational reports and logs looking for irregularities and abnormal patterns
</li><li>Basic knowledge of IT organization patterns
</li><li>Demonstrated proficiency with MS Office, Excel, Word and PowerPoint
</li><li>This job operates in a professional office environment
</li><li>To successfully perform the essential functions of the job there may be physical requirements which need to be met such as sitting for long periods of time and using computer monitors/equipment
</li></ul><p>Preferred:
</p><ul><li>Significant Internship in security, privacy, business continuity, compliance or related area(s)
</li><li>One or more of the following certifications: GSEC, GCED, GCDA, Security+, Security Pro or equivalent</li></ul></div>
<br><div><div>Church employees find joy and satisfaction in using their unique talents and abilities to further the Lord&rsquo;s work. From the IT professional who develops an app that sends the gospel message worldwide, to the facilities manager who maintains our buildings&mdash; giving Church members places to worship, teach, learn, and receive sacred ordinances&mdash;our employees seek innovative ways to share the gospel of Jesus Christ with the world. They are literally working in His kingdom.
</div><div>Only members of the Church who are worthy of a temple recommend qualify for employment. Apart from this, the Church is an equal opportunity employer and does not discriminate in its employment decisions on any basis that would violate U.S. or local law.
</div><div>Qualified applicants will be considered for employment without regard to race, national origin, color, gender, pregnancy, marital status, age, disability, genetic information, veteran status, or other legally protected categories that apply to the Church. The Church will make reasonable accommodations for qualified individuals with known disabilities.</div></div>

IT Risk & Compliance Analyst 2

Starbucks

<div><p><b>Now Brewing &ndash; Cybersecurity Analyst, Sr. &ndash; Governance Risk &amp; Compliance! #tobeapartner</b></p><p>
From the beginning, Starbucks set out to be a different kind of company. One that not only celebrated coffee and the rich tradition, but that also brought a feeling of connection. We are known for developing extraordinary leaders who share this passion and are guided by their service to others.</p><p><br>
Are you passionate about leading complex technical initiatives that strengthen our security posture and protect our partners, customers and brand? As a Cybersecurity Analyst, Sr. on the Cybersecurity Project Management team, you will drive high-impact, cross-functional programs and initiatives that deliver governance, risk and compliance and risk-mitigation capabilities across the enterprise.</p><p><br>
You bring clarity to ambiguity, create structure in fast-moving environments and execute with precision. This role requires a strategic thinker who is deeply hands-on, capable of guiding programs from initial concept through planning, execution, deployment and successful closeout. You will partner closely with engineering, security and business teams to translate cybersecurity compliance requirements into actionable plans that deliver measurable outcomes and reduce organizational risk.</p><p></p><p><b><br>
As a Cybersecurity Analyst, Sr, you will&hellip;</b></p><ul><li>
Lead large-scale, highly complex cybersecurity, infrastructure and governance, risk and compliance (GRC) initiatives from concept to delivery, coordinating across multiple teams and regions.</li><li>
Translate complex technical and security and compliance challenges into structured, actionable project plans, ensuring alignment and coordination across cross-functional delivery teams.</li><li>
Drive execution with rigor and attention to detail, while maintaining strong governance and risk management practices.</li><li>
Communicate with executive presence, delivering crisp updates and influencing decision-making across all levels of the organization.</li><li>
Develop and execute organizational change management plans &ndash; including communication strategies, readiness assessments, stakeholder engagement and training coordination across multiple concurrent projects.</li></ul><br>
<p><i>
We&rsquo;d love to hear from people with:</i></p><ul><li>
10+ years of analyst or program/project management experience, including 3+ years leading and supporting governance, risk and compliance programs within large or highly regulated organizations.</li><li>
Proven success managing large, cross-functional programs with multiple workstreams and global stakeholders.</li><li>
Familiarity with GRC processes and frameworks including PCI DSS, SWIFT, SOC 2, ISO 27001/27002, NIST CSF, and broader enterprise risk management practices.</li><li>
Experience managing deployment and integration of technical or security solutions across global environments, ensuring alignment with enterprise controls, standards and audit/compliance requirements.</li><li>
Hands-on experience supporting compliance initiatives (e.g. evidence collection, control validation, remediation planning, reporting), with the ability to translate requirements to actionable delivery plans.</li><li>
Strong organizational skills and a proactive, execution-focused mindset, with a track record of driving clarity, managing risk, and delivering results in fast-paced or ambiguous environments.</li><li>
Ability to anticipate compliance risks, identify control gaps, and partner with engineering, security and audit teams to ensure effective remediation and sustainable control posture.</li><li>
Experience applying organizational change management (OCM) frameworks (e.g. ADKAR, Prosci) across technical, security or compliance-driven initiatives</li></ul><p></p><div><p><br>
As a Starbucks partner, you (and your family) will have access to medical, dental, vision, basic and supplemental life insurance, and other voluntary insurance benefits. Partners have access to short-term and long-term disability, paid parental leave, family expansion reimbursement, paid vacation from date of hire*, sick time (accrued at 1 hour for every 25 hours worked), eight paid holidays, and two personal days per year. Starbucks also offers eligible partners participation in a 401(k) retirement plan with employer match, a discounted company stock program (S.I.P.), Starbucks equity program (Bean Stock), incentivized emergency savings, and financial well-being tools. Additionally, Starbucks offers 100% upfront tuition coverage for a first-time bachelor&rsquo;s degree through Arizona State University&rsquo;s online program via the Starbucks College Achievement Plan, student loan management resources, and access to other educational opportunities. You will also have access to backup care and DACA reimbursement. Starbucks will comply with any applicable state and local laws regarding employee leave benefits, including, but not limited to providing time off pursuant to the Colorado Healthy Families and Workplaces Act, and in accordance with its plans and policies. This list is subject to change depending on collective bargaining in locations where partners have a certified bargaining representative. For additional information regarding partner perks and more detailed information about benefits, go to starbucksbenefits.com.</p></div><div><ul><li>If you are working in CA, CO, IL, LA, ME, MA, NE, ND or RI, you will accrue vacation up to a maximum of 120 hours (190 in CA) for roles below director and 200 hours (316 in CA) for roles at director or above. For roles in other states, you will be granted vacation time starting at 120 hours annually for roles below director and 200 hours annually for roles director and above.</li></ul></div><p></p><div><p><br>
The actual base pay offered to the successful candidate will be based on multiple factors, including but not limited to job-related knowledge/skills, experience, geographical location, and internal equity. At Starbucks, it is not typical for an individual to be hired at the high end of the range for their role, and compensation decisions are dependent upon the facts and circumstances of each position and candidate.</p></div><p></p><div><p><b><br>
Join us and </b><b>inspire with</b><b> </b><b>every</b><b> cup. Apply today!</b></p></div><div><p><i>
Starbucks Coffee Company is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, or protected veteran status, or any other characteristic protected by law.</i></p></div><div><p><i>
Qualified applicants with criminal histories will be considered for employment in a manner consistent with all federal, state and local ordinances.</i><br>
<br>
<i>Starbucks Coffee Company is committed to offering reasonable accommodations to job applicants with disabilities. If you need assistance or an accommodation due to a disability, please contact us at </i><i>applicantaccommodation@starbucks.com</i><i> or 1(888) 611-2258.</i></p></div></div>

cybersecurity analyst senior - governance, risk, and compliance

Tire Rack

<div><p><b>Sr. Information Security GRC Analyst</b></p>
<p><b>
Location:</b> Tire Rack &ndash; South Bend, IN (On-Site)<br>
<b>Department:</b> Information Security</p>
<p><b>
Employment Type:</b> Full-Time<br>
<b>Salary Range:</b> $115,000-$125,000 annually</p><br>
<p></p>
<p><b>
About the Role</b></p>
<p>
Tire Rack is seeking a Senior Information Security GRC Analyst to support and advance our Information Security Governance, Risk, and Compliance (GRC) program</p>
<p>
.</p>
<p>
In this role, you will assess and strengthen IT and security controls across the organization while ensuring alignment with regulatory, statutory, and industry security standards including ISO/IEC 27001:2022, PCI DSS, and internal security policies.</p><br>
<p></p>
<p>
This position works closely with IT teams, business leaders, and audit stakeholders to identify risk exposures, strengthen control frameworks, support audit readiness, and drive continuous improvement in Tire Rack&rsquo;s overall security posture.</p><br>
<p></p>
<p>
This role requires a strong mix of technical understanding, risk assessment expertise, and the ability to translate compliance requirements into practical, business-aligned security controls.</p><br>
<p></p>
<p>
At Tire Rack, we operate with the values of IOOGA &mdash; Integrity, Our People, Our Customers, Growth, and Attitude.</p><br>
<p></p>
<p><b>
What You'll Do</b></p><br>
<p></p>
<p><b>
Governance, Risk &amp; Compliance Leadership</b></p>
<ul><li>
Advise IT and business stakeholders on governance, risk, and compliance requirements by interpreting regulatory, statutory, and security standards and translating them into actionable control recommendations.</li><li>
Lead and support the organization&rsquo;s information security risk management program, including risk identification, assessment, documentation, and monitoring mitigation strategies.</li><li>
Evaluate technology risks and recommend practical mitigation strategies aligned with business objectives.</li></ul>
<p><b>
Controls &amp; Compliance</b></p>
<ul><li>
Develop and maintain GRC program documentation including:</li><li><ul><li>
Security policies</li><li>
Standards and procedures</li><li>
Risk registers</li><li>
Control inventories</li><li>
Evidence repositories</li></ul>
</li><li>Strengthen internal security controls by identifying opportunities to improve standardization, documentation, and compliance alignment.</li><li>
Define and communicate control expectations, testing procedures, and audit evidence requirements across teams.</li></ul>
<p><b>
Audit &amp; Testing</b></p>
<ul><li>
Coordinate internal and external audits, including planning, evidence collection, stakeholder coordination, and remediation tracking.</li><li>
Execute security control testing by:</li><li><ul><li>
Defining scope</li><li>
Reviewing and validating evidence</li><li>
Documenting results</li><li>
Identifying deficiencies</li><li>
Tracking remediation through resolution.</li></ul>
</li><li>Manage compliance findings, corrective actions, and risk acceptance documentation.</li></ul><br>
<p></p>
<p><b>
Program Improvement</b></p>
<ul><li>
Support security initiatives and technology projects by embedding governance, risk, and compliance practices into delivery.</li><li>
Track program metrics, audit results, and compliance trends to improve security maturity over time.</li><li>
Provide recommendations to strengthen Tire Rack&rsquo;s overall security and compliance framework.</li><li>
Perform other duties as assigned in support of the Information Security and Technology organization.</li></ul>
<p><b>
What We're Looking For</b></p>
<p>
We are looking for a security professional who brings both technical understanding and risk management expertise while partnering effectively across teams.</p><br>
<p></p>
<p><b>
Required Experience</b></p>
<ul><li>
5&ndash;7 years of experience in IT, cybersecurity, risk management, audit, or compliance roles.</li><li>
Strong knowledge of information security frameworks including:</li><li><ul><li>
ISO/IEC 27001</li><li>
PCI DSS</li><li>
Familiarity with GDPR concepts</li></ul>
</li><li>Understanding of IT environments, systems, and security controls across infrastructure, applications, and data environments.</li></ul>
<p><b>
Skills &amp; Competencies</b></p>
<ul><li>
Strong analytical and problem-solving abilities with the capacity to identify trends, patterns, and control risks.</li><li>
Ability to evaluate control design and operational effectiveness.</li><li>
Excellent documentation, organization, and attention to detail.</li><li>
Strong communication skills with the ability to explain complex technical or compliance concepts to both technical and non-technical audiences.</li><li>
Ability to work independently while collaborating effectively with cross-functional stakeholders.</li></ul>
<p><b>
Required Certifications (One or more)</b></p>
<p>
Candidates must possess one or more of the following professional certifications, or be able to obtain one within a reasonable period after hire:</p>
<ul><li>
CISA (Certified Information Systems Auditor)</li><li>
CRISC (Certified in Risk and Information Systems Control)</li><li>
CISSP (Certified Information Systems Security Professional)</li><li>
CISM (Certified Information Security Manager)</li><li>
CompTIA Security+</li></ul>
<p>
Equivalent or comparable information security, audit, risk, or compliance certifications may also be considered.</p><br>
<p></p>
<p><b>
Education</b></p>
<ul><li>
Bachelor&rsquo;s Degree in Information Systems, Information Technology, Cybersecurity, Risk Management, or a related field.</li></ul>
<p><b>
Work Schedule</b></p>
<p><b>
Work Days:</b><br>
Monday through Friday<br>
Occasional weekends may be required.</p>
<p><b>
Work Hours:</b><br>
8:00 a.m. &ndash; 5:00 p.m.<br>
Additional hours may be required depending on project or audit needs.</p><br>
<p></p>
<p>
#HP</p></div>

Sr. Information Security GRC Analyst

BELL BANK

<div><p>The IT Security Analyst is responsible for overseeing and enhancing the patch management and vulnerability remediation processes across the organization. This role ensures timely identification, tracking, and resolution of vulnerabilities, including End-of-Life (EOL) software and hardware, to maintain a secure and compliant IT environment. The analyst coordinates cross-functional teams to drive remediation efforts, supports audit responses, and drives continuous improvement in security operations.<br>
<br>
<b>Responsibilities:</b></p>
<p>
</p><p><b>Vulnerability &amp; Patch Management</b></p>
<ul>
<li>Lead vulnerability analysis and prioritization based on risk, business impact, and threat intelligence; recommend remediation strategies to IT leadership.</li>
<li>Oversee the patch management lifecycle, ensuring timely application of security updates.</li>
<li>Maintain accurate records and databases of vulnerabilities, remediation status, and vendor updates.</li>
<li>Monitor and track asset vulnerabilities, including EOL software/hardware, for proactive planning.</li>
<li>Assess and quantify risk related to asset lifecycles.</li>
<li>Research and validate patches daily from vendor sources and threat intelligence feeds.</li>
<li>Assign remediation tasks to patching administrators and follow up on completion.</li>
<li>Facilitate weekly patch status meetings and report progress to leadership.</li>
<li>Design and implement metrics-driven dashboards to track remediation progress, trends, and effectiveness across the organization.</li>
<li>Evaluate and optimize patch management processes, identifying opportunities for automation and continuous improvement.</li>
<li>Conduct root cause analysis on recurring vulnerabilities and propose long-term solutions to mitigate systemic risks.</li>
</ul>
<p><b>Policy &amp; Risk Oversight</b></p>
<ul>
<li>Develop, review, and maintain vulnerability management policies and procedures.</li>
<li>Create risk models to quantify and communicate potential business impact.</li>
<li>Ensure assets run current versions of standardized operational and security software.</li>
<li>Analyze asset lifecycle data to forecast future remediation needs and budgetary impacts.</li>
<li>Collaborate with vendors and internal teams to remediate identified vulnerabilities.</li>
</ul>
<p><b>Reporting &amp; Compliance</b></p>
<ul>
<li>Prepare executive-level reports and presentations that translate technical remediation data into actionable business insights.</li>
<li>Coordinate with audit, compliance, and legal teams to ensure remediation activities meet all regulatory and policy standards.</li>
<li>Serve as the primary point of contact for internal and external stakeholders regarding vulnerability remediation status, strategy, and outcomes.</li>
<li>Develop and deliver training materials to IT staff and business units on remediation best practices and emerging threats.</li>
<li>Proactively identify and resolve false positives in vulnerability scans and assessments.</li>
</ul>
<p><b>Continuous Improvement &amp; Innovation</b></p>
<ul>
<li>Research and recommend new tools, technologies, and methodologies to enhance vulnerability detection and remediation capabilities.</li>
<li>Benchmark organizational remediation performance against industry standards and peer organizations, driving adoption of best practices.</li>
<li>Lead post-remediation reviews to assess effectiveness and document lessons learned for future process enhancements.</li>
</ul>
<p><b>Bell Bank Culture, Policy and Accountability Standards:</b></p>
<ul>
<li>Know by name and face as many customers and employees as possible, calling them by name as often as possible.</li>
<li>Know and practice LOCBUTN, our Golden Rules, and Bell Bank Customer Service Standards.</li>
<li>Know, understand, and live the company values and bottom line.</li>
<li>Conduct activities consistent with established Bell Bank policies, procedures and systems, the Bell Bank Employee Conduct policies, the Bank Secrecy Act and all applicable state and federal laws and regulations.</li>
<li>All employees are responsible for information security, including compliance with policies and standards which protect sensitive information.</li>
<li>Prompt and reliable attendance.</li>
<li>Perform other duties as assigned.</li>
</ul>
<p><b>Education, Experience, and Other Expectations</b></p>
<ul>
<li>Bachelor's degree in Information Technology or similar field or equivalent work experience.</li>
<li>4-6 years of experience in IT risk, vulnerability management, or cybersecurity.</li>
<li>Industry certifications such as CISSP, CISA, or Security+ are preferred.</li>
<li>Experience coordinating multi-team resources to meet remediation objectives.</li>
<li>Experience with vulnerability scanning tools, remediation streams, and release schedules.</li>
</ul>
<p><b>Skills and Knowledge</b></p>
<ul>
<li>Strong knowledge of vulnerability release schedules and patching best practices.</li>
<li>Ability to assess and prioritize vulnerability risk data effectively.</li>
<li>Proficiency in creating advanced reports and organizing complex data streams.</li>
<li>Skilled in using vulnerability scanning, asset management, and asset discovery tools.</li>
<li>Ability to research and respond to technical inquiries related to vulnerabilities.</li>
<li>Strong organizational and meeting facilitation skills.</li>
<li>Excellent analytical, communication, and project management skills.</li>
<li>Ability to lead multi faced teams in a coordinated fashion.</li>
<li>Provide feedback and guidance to IT staff on remediation efforts.</li>
</ul>
<br>
Additional Details :
<div><p>If you like to work with people in a family atmosphere, enjoy great benefits and provide unequaled personal service to every customer, consider a career with Bell Bank.</p>
<p>
Bell Bank was founded in 1966 and is headquartered in Fargo, North Dakota. It is the largest family-and employee-owned bank in the upper Midwest, and one of the largest in the nation, with assets of more than $14 billion. Bell Bank has full-service banking locations in North Dakota, Minnesota and Arizona. Bell has empowered more than $30 million in charitable giving through its unique Pay It Forward initiative, through which every employee chooses each year how to help individuals, families and organizations in need.</p>
<p>
Bell Bank has been recognized as a top workplace by American Banker, Forbes and Fortune. If you want to work for an established, growing, forward-looking organization with world-class employees, this is the place for you. Let Bell Bank be your destination workplace.</p>
<p><b>
Bell's Values:</b></p>
<p>
As stewards, dedicated to the growth and reputation of this independently owned organization, we are committed to:</p>
<ul>
<li>Promoting and sustaining our family atmosphere.</li>
<li>Providing unequaled personal service to each and every customer.</li>
<li>Paying it forward</li>
</ul>
<p><b>Our Bottom Line:</b></p>
<p>
Happy Employees! Happy Customers!</p>
<p>
</p><p>In addition to salary, Bell Bank offers a comprehensive benefits package including, healthcare, (medical, dental, vision) employee stock ownership program, and 401(k) contribution and profit-sharing plan. All benefits are subject to eligibility requirements.</p>
<div>
</div><div><b>Bell Bank</b></div>
<div><b>Equal Opportunity Employer</b></div></div></div>

IT Security Analyst

Contour Software

<div><div>About Contour</div><div></div><div><div>
Contour Software</div> has grown from a dozen people to over 2,000 staff across 3 cities, in less than 14 years.</div><div><br>
As a subsidiary of Constellation Software Inc., we are proud to be part of a global enterprise software conglomerate that has grown to become one of the top 10 software companies in the world, with employees and customers in 100+ countries. With a broad-based and ever-growing portfolio of market-leading, vertical-market enterprise solutions covering more than 100 industry domains in predominantly mature markets, CSI's recipe creates the perfect environment for professionals to build fulfilling, long-term careers.</div><div><br>
What started as an R&amp;D &amp; Accounting back-office, has progressed into a full-service Global Centre serving all functions and departments, at the divisional as well as operating group/corporate level. Today Contour employees, located in Karachi, Lahore &amp; Islamabad, are serving CSI divisions located in time zones spanning the globe, from Sydney to Vancouver. With the global growth of Constellation as the wind in our sails, we are only just getting started!</div><div></div><div><div><div>
The Division:<br>
<div>FOG Software Group</div> - a division of Vela Software Group part of Constellation Software Inc. - specializes in complete ERP solutions for manufacturers and distributors of make-to-order and engineer-to-order products in the building products, capital equipment, and automotive sectors. FOG also includes a complementary portfolio of software solutions for transportation management, material optimization, supply-chain management, multi-channel merchant, and direct-to-consumer distribution.<br>
<br>
The Position:<br>
As GRC Analyst for the FOG Software group , you will support certain companies within the FOG Software operating group to meet the regulatory and compliance requirements specifically PCI DSS as well support in meeting the Vela compliance requirements by working with specific business units IT, customer support, development teams as well as Vela GRC. We are looking for individuals who move fast, can break down and solve complex problems, and have strong ethical values.<br>
The hired candidate will be located and work out of the Contour Software Islamabad/Karachi/Lahore office, working as part of the resource-center, as an extension of the division-based G&amp;A department.<br>
<br>
Responsibilities:</div></div><div><div>
Document and implement information security policies and standards (related to PCI-DSS and NIST CSF compliance requirements) specific to certain business units.</div></div><div><div>
Lead the PCI-DSS compliance initiatives, monitor, and report the gaps in compliance to management.</div></div><div><div>
Review information systems, IT and SSDLC practices to ensure compliance with business unit's GDPR/ISO/PCI-DSS requirements as well as Vela security framework requirements including processes, standards, policies, and procedures.</div></div><div><div>
Conduct risk assessments to identify potential risk events and assist with quantifying their probability of occurrence and impact on the business and work with risk owners in mitigating those risks.</div></div><div><div>
Collaborate IT TechOps and security team to monitor risks and compliance status, report and develop countermeasures and contingency plans.</div></div><div><div>
Monitor the security logs of anti-virus and SIEM/IDS to verify that all systems are up-to-date and all incidents are being logged, monitored and timely responded to as per policy requirements.</div></div><div><div>
Monitor and evaluate security measures in collaboration with the IT TechOp team to protect against reasonably anticipated threats or hazards to the privacy, security, or integrity of protected information (PII, PCI).</div></div><div><div>
Manage external audits and assessments, oversee audit findings and management actions plans. Ensure corrective actions are taken. Work with risk owners in developing risk treatment plans, time estimations, follow-up and report status on action plans.</div></div><div><div>
Perform tasks as set forth by the management team.</div></div><div><div>
Provide security awareness and compliance trainings to the IT team as well as end-users in line with the PCI-DSS requirements.</div></div></div><div><div><div><br>
<br>
Qualification(s):</div></div><div><div>
Bachelor's Degree in Information Technology or related technical field.</div></div><div><div>
Candidate should have a minimum of 3+ years either Information Security Risk or Cyber Security Risk experience.</div></div><div><div>
Must have knowledge of cloud-based environments (AWS, GCP, Azure, etc.) with cloud governance experience.</div></div><div><div>
Must have experience in working in e-commerce environments and PCI-DSS V3.2.1/4.0.</div></div><div><div>
Sound working knowledge of industry best practices (NIST, ISO, SANS, COBIT) and Legislative and Regulatory and Industry Compliance Requirements (PCI, CCPA, GDPR etc.).</div></div><div><div>
Clear understanding of SDLC process and how Security validation is tied to that.</div></div><div><div>
Must have exceptional written, verbal and presentation communication skills.</div></div><div><div>
Ability to facilitate cross-functional teams.</div></div><div><div>
Ability to translate business requirements into control objectives.</div></div></div><div><div><div>
Strong project management skills.</div></div><div><div><br>
<br>
Good to Have:</div></div><div><ul><li><div>
Experience with PCI-DSS v4.0</div></li></ul></div><div><ul><li><div>
Experience of GRC Tools (such as Service Now, RSA Archer, 6Clicks)</div></li></ul></div><div><div><br>
One or more of the following certifications:</div></div><div><ul><li><div>
ISO 27001 Lead auditor/Implementer</div></li></ul></div><div><ul><li><div>
CISM, CISA and/or CISSP</div></li></ul></div><div><ul><li><div>
CRISC</div></li></ul></div><div><div><br>
<br>
Work Shift Timings:</div></div><div><ul><li><div>
6:00 pm to 3:00 am (Pakistan Standard Time) &ndash; 7:00 am to 4:00 pm (Central Time Zone)</div></li></ul></div></div><div></div><div><br>
Exciting Benefits we offer:</div><ul><li><div>
Market-leading Salary</div></li><li><div>
Medical Coverage &ndash; Self &amp; Dependents</div></li><li><div>
Parents Medical Coverage</div></li><li><div>
Provident Fund</div></li><li><div>
Employee Performance-based bonuses</div></li><li><div>
Home Internet Subsidy</div></li><li><div>
Conveyance Allowance</div></li><li><div>
Profit Sharing Plan [Tenured Employees Only]</div></li><li><div>
Life Benefit</div></li><li><div>
Child Care Facility</div></li><li><div>
Company Provided Lunch/Dinner</div></li><li><div>
Professional Development Budget</div></li><li><div>
Recreational area for in-house games</div></li><li><div>
Sporadic On-shore training opportunities</div></li><li><div>
Friendly work environment</div></li><li><div>
Leave Encashment</div></li></ul><div></div><div><i>
Disclaimer:</i><i> At Contour, we attribute our success to the unique contributions of our diverse staff. We&rsquo;re committed to fostering a culture of respect that thrives on the varied perspectives and experiences of all individuals we recruit, employ, promote, and compensate. Since day one, we&rsquo;ve adhered to a policy that champions a work environment honoring the worth and dignity of each person while being free from all forms of employment discrimination.</i></div><div></div><div><i>
In our continuous effort to promote inclusivity, we extend our commitment to individuals with special needs by providing reasonable accommodations. We actively encourage qualified individuals with special needs to apply for the various openings within our company. Should you require assistance in completing the application process or have any inquiries regarding special facilities, please do not hesitate to contact our HR team. Your unique talents and abilities are welcomed and valued here.</i></div></div><div></div>

GRC Analyst

Sargent & Lundy

<div>Description:
<div>
Sargent &amp; Lundy is a leading consulting engineering firm specializing in the power and energy sectors. Since 1891, we have provided comprehensive engineering, design, and consulting services for both traditional and renewable power generation, grid modernization, nuclear power, and beyond. Our mission is to help clients achieve their energy goals effectively by leveraging advanced technologies and adopting sustainable practices.</div><h4 class="jobSectionHeader"><b>
Role Overview</b></h4><div>
Sargent &amp; Lundy is seeking a proactive, data-driven, and detail-oriented Senior GRC Analyst to lead key pillars of Governance, Risk, and Compliance (GRC) with a primary emphasis on enterprise Information Security, TPRM, contract governance, and cross-functional coordination with Legal and Procurement. You will own cyber training, communications, and phishing simulations, and drive measurable outcomes through strong data analysis and dashboard reporting (KPIs/KRIs). You will support audit readiness and regulatory alignment across frameworks such as ISO 27001, SOC 2, NIST CSF/171, and CMMC. You will also guide privacy-aligned practices (e.g., GDPR) and lead effective policy implementation through clear procedures, controls, and adoption plans.</div><p><b>
Essential Responsibilities</b></p><ul><li>
Lead and mature the Third-Party Risk Management (TPRM) program: Develop &amp; manage vendors inventory, conduct risk reviews of third-party vendors, define tiering/scoping, evaluate controls, track obligations/findings through closure, and standardize evidence retention in collaboration with Legal and Procurement.</li><li>
Drive strong contract management with Legal and Procurement: Standardize security and privacy clauses, review S&amp;L client contracts, negotiate requirements, and ensure obligations are tracked, owned, and reported.</li><li>
Own the security awareness &amp; training program end-to-end: Develop curriculum, coordinate communications, execute phishing simulations, analyze outcomes, and improve effectiveness using KPI/KRI dashboards and trend reporting.</li><li>
Administer and optimize GRC platforms and workflows (e.g., Hyperproof) to maintain visibility into risks, assessments, findings, and audit deliverables; establish SLAs and performance indicators.</li><li>
Develop risk management &amp; risk assessment practice, conduct risk assessments, develop and manage risk register with clear tracking of risks and accountability.</li><li>
Advance security governance by drafting, maintaining, and operationalizing policies, standards, procedures, and roles &amp; responsibilities; lead change management and communications to ensure policy implementation and adoption.</li><li>
Coordinate evidence and execute control readiness for ISO 27001, SOC 2, NIST CSF, CMMC (gap analysis, control testing, POA&amp;Ms), and support automation that reduces workload.</li><li>
Support privacy-aligned practices (e.g., GDPR): contribute to data classification/handling standards, data mapping/records of processing, privacy-by-design reviews, incident/breach alignment, and retention practices.</li><li>
Oversee governance for Business Continuity and Disaster Recovery and Backup &amp; Recovery in partnership with IT (plan maintenance, exercises, lessons learned, reporting).</li><li>
Lead cross-functional coordination with IT, HR, Finance, Legal, and business teams to embed compliance into operations and accelerate remediation of findings.</li><li>
 Manage security tasks/projects and report progress via standardized dashboards, scorecards, and executive-ready narratives, highlighting risk, performance, and trends. - Define, publish, and automate metrics &amp; management reporting (KPIs/KRIs) for training effectiveness, phishing trends, vendor risk, audit readiness, privacy/policy adoption, and control performance.</li><li>
Continuously upgrade information security skills, contribute to Information Security team skill development with playbooks, enablement sessions, and knowledge-sharing.</li><li>
 Support government contract compliance reviews and tracking, ensuring obligations are documented, monitored, and evidenced.</li></ul><div></div><div><b><br>
Core Areas of Responsibility (Scope)</b></div><br>
<div></div><ul><li>
 Information Security Governance, Policies, Standards, Procedures, and Roles &amp; Responsibilities.</li><li>
 Risk Management &ndash; Information security risk management and risk assessments</li><li>
Compliance management &ndash; Audit evidence management, audit coordination and compliance monitoring</li><li>
Third Party Risk Management - Third Party Risk Management, Vendor Assessments, Client Contract Reviews and obligation management.</li><li>
Security Awareness &amp; Training &mdash; including communications and phishing simulations: Hoxhunt and Mimecast</li><li>
 Coordination with IT, HR, Finance, Legal, and Business Teams. - Security Tasks/Projects Management.</li><li>
Metrics &amp; Management Reporting &mdash; strong emphasis on data analysis and dashboarding. Information Security Team Skill Development.</li><li>
Government Contract Compliance Reviews and Tracking.</li><li>
Deep Knowledge of Governance &amp; Privacy</li><li>
Policy lifecycle management and control mapping; demonstrated ability to translate policy into procedures/controls and drive organization-wide policy implementation and adoption.</li><li>
Privacy principles and GDPR-aligned practices (e.g., data classification/handling, data mapping/records of processing, privacy by design, incident/breach communications aligned to policy).</li><li>
 Compliance standards and frameworks (ISO 27001, NIST CSF, SOC 2, CMMC).</li><li>
 Third-party risk, software intake governance, audit readiness, and evidence management.</li><li>
Security &amp; TPRM Tools - TPRM platforms: ProcessUnity (Vendor Risk, Contract/Obligations, Issues/Findings tracking). - TPRM intelligence/workflow: OneTrust, BitSight (as applicable).</li><li>
GRC/risk registers: Hyperproof (risk, controls, evidence, audits). - Data analytics and reporting: Power BI and Excel (for KPI/KRI dashboards and executive reporting).</li><li>
Business Continuity and Disaster Recovery Process Oversight. - Backup &amp; Recovery Process Oversight.</li><li>
Mentoring, cross functional team collaboration and executive reporting</li></ul><div></div><p><b><br>
This position offers the flexibility of a hybrid schedule with the expectation of 3 days per week in our downtown Chicago office, and 2 days remote from home.</b></p>
Qualifications:
<h1 class="jobSectionHeader"><b>Required Qualifications</b></h1><ul><li>
 Bachelor&rsquo;s degree in computer science, information systems, or related field; or equivalent professional experience.</li><li>
5+ years in GRC or related domains, including leadership/ownership of programs or workstreams.</li><li>
 Strong understanding of ISO 27001, SOC 2, NIST CSF; experience with CMMC readiness.</li><li>
Practical knowledge of privacy and GDPR with the ability to implement policy via procedures, controls, communications, and training.</li><li>
Proven expertise in risk management, compliance operations, policy/standards, vendor risk, resilience, security training/awareness, and audit readiness.</li><li>
Advanced data analysis skills with the ability to design and maintain KPI/KRI dashboards, translate data into insights, and present executive-ready reporting.</li><li>
Familiarity with security technologies across on-prem and cloud environments; strong problem-solving and systems thinking.</li><li>
Professional certifications (e.g., CISSP, CISM, CRISC) are advantageous.</li></ul><h1 class="jobSectionHeader"><b>
Soft Skills</b></h1><ul><li><b>
Compassionate </b><b>Candor</b>: Provide candid, actionable feedback to enhance team performance and individual growth.</li><li><b>
Seek</b><b> to Understand</b>: Embrace curiosity and a commitment to continuous learning, fostering an environment of collaboration and innovation.</li><li><b>
We Before Me</b>: Actively collaborate and engage diverse perspectives to ensure collective success.</li><li><b>
Do What You Say</b>: Take ownership of commitments, prioritizing and delivering on key initiatives.</li><li><b>
Light Up Learning</b>: Encourage bravery in trying new ideas, sharing failures as opportunities for growth and learning.</li><li><b>
Driven by Passion</b>: Connect personal passion to the mission, demonstrating resilience in the face of challenges while pursuing organizational goals.</li></ul><div></div><div><b><br>
Why Join Us?</b></div><ul><li>
Work in an established company that values innovation and growth.</li><li>
Engage with a collaborative team that is dedicated to making a meaningful impact in the energy sector.</li><li>
Gain exposure to cutting-edge projects and contribute to data-driven decision-making processes.</li></ul><div></div><p><b><br>
We do not sponsor employees for work authorization in the U.S. for this position.</b></p><br>
<p></p>
Award-Winning Benefits:
<p>
At Sargent &amp; Lundy, we care about the health and well-being of our employees. Our commitment extends beyond the workplace, offering comprehensive healthcare plans and generous paid time off to support our team members in every aspect of their lives. We understand the importance of work-life balance, which is why we are proud to provide competitive, award-winning benefits. Our dedication to employee satisfaction has earned us the prestigious Top Workplaces Culture Excellence Award for compensation and benefits in 2022, 2023, and 2024.</p><p></p><div><div><div><b><br>
Health &amp; Wellness</b></div><div><b> Financial Benefits</b></div><div><b> Work-Life Balance</b></div></div><br>
<div><ul><li>
Health Plans: Medical, Dental, Vision</li><li>
Life &amp; Accident Insurance</li><li>
Disability Coverage</li><li>
Employee Assistance Program (EAP)</li><li>
Back-Up Daycare</li><li>
FSA &amp; HSA</li></ul><ul><li>
401(k)</li><li>
Pre-Tax Commuter Account</li><li>
Merit Scholarship Program</li><li>
Employee Discount Program</li><li>
Corporate Charitable Giving Program</li><li>
Tuition Assistance</li><li>
First Professional Licensure Bonus</li><li>
Employee Referral Bonus</li></ul><ul><li>
Paid Annual Personal/Sick Time (PST)</li><li>
Paid Vacation</li><li>
Paid Holidays</li><li>
Paid Parental Leave</li><li>
Paid Bereavement Leave</li><li>
Flexible Work Arrangements</li></ul></div><br>
</div>
Compensation Range: $100,010.00 - $144,190.00 Transparency Statement: Sargent &amp; Lundy discloses compensation ranges that comply with all local and state regulations. The total compensation package for eligible positions will include a base salary or an hourly rate and a comprehensive benefits package, reflecting our commitment to rewarding performance and supporting the overall well-being of our employees. Individuals may also be eligible to participate in our yearly discretionary bonus. Awards &amp; Recognition:
<div></div>
Equal Opportunity:
<div>
Sargent &amp; Lundy is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, national origin, disability status, protected veteran status, or any protected status as defined by applicable law.</div></div>

Senior GRC Analyst

Search 10000+ Risk and compliance analyst jobs near you this March. New roles added regularly across leading industries. Apply today.