Sr. Information Security Governance, Risk and Compliance Analyst

• This is a remote, work-from-home position, but the final round of interviews will take place on-site in our Chattanooga, TN office.
• Candidates must be able to work Eastern Time Zone business hours.
• Participation in an on-call rotation is required for approximately two weeks every 30 weeks.
• Sponsorship is not available for this role.

Job Responsibilities

• Lead SOC 2 Audit Support – Coordinate audit activities including evidence collection, control validation, and auditor engagement.
• Manage and Validate Control Frameworks – Maintain control documentation, mappings, and narratives while partnering with control owners to ensure effectiveness and alignment with Trust Services Criteria and NIST frameworks.
• Track Audit & Remediation Activities – Oversee audit findings, remediation efforts, and timely closure of issues.
• Develop & Maintain NIST SSPs – Create and update System Security Plans (SSPs), including control implementations, inheritance, and system boundaries.
• Drive Security Awareness Programs – Design and manage training initiatives, including phishing simulations and targeted campaigns.
• Manage Policies & Governance Documentation – Oversee the full lifecycle of security policies, standards, and procedures to ensure compliance and audit readiness.
• Conduct Enterprise & Third-Party Risk Management – Perform risk assessments, maintain risk registers, execute vendor risk assessments, and monitor remediation.
• Oversee Vulnerability Management – Track vulnerability remediation against SLAs and collaborate with teams to mitigate risks.
• Support Customer Security Assurance – Respond to RFPs and security questionnaires, ensuring accurate, compliant, and consistent security representations.
• Leadership – Leads by example, actively supporting initiatives across all GRC areas while fostering a culture of collaboration and shared accountability.

Job Qualifications
Education

• Bachelor’s degree in a relevant field or an equivalent of four years of experience is required. 

Experience

• 5 years - Professional experience in Information Security or related IT roles with security-related responsibilities, including at least 2 years focused on Governance, Risk, and Compliance (GRC) functions.
• Experience leveraging AI-enabled tools to automate and enhance GRC processes, improving efficiency, consistency, and scalability of governance, risk, and compliance activities preferred.

Skills/Certifications

• Preferred, one or more of the following certifications required: CISSP, CRISC, CISA, or CISM.
• Ability to assess and document organizational risks, including identifying impacts and recommending mitigation strategies.
• Ability to interpret and apply regulatory requirements and industry frameworks (e.g., NIST, SOC 2, HIPAA) to organizational controls.
• Ability to analyze security, compliance, and risk metrics to identify trends and drive continuous improvement.
• Ability to communicate complex risk and compliance concepts clearly to both technical and non-technical stakeholders.
• Ability to collaborate effectively across cross-functional teams to integrate governance, risk, and compliance practices into business processes.
• Exceptional time management skills.
• Excellent oral and written communication skills.
• Strong interpersonal skills and ability to cultivate relationships with internal and external stakeholders, promoting diversity of people, perspectives and ideas.
• Ability to work with all levels of staff and management.
   

N/A

Number of Openings Available

Worker Type:

Company:

Applying for this job indicates your acknowledgement and understanding of the following statements:

BCBST will recruit, hire, train and promote individuals in all job classifications without regard to race, religion, color, age, sex, national origin, citizenship, pregnancy, veteran status, sexual orientation, physical or mental disability, gender identity, or any other characteristic protected by applicable law.

Further information regarding BCBST's EEO Policies/Notices may be found by reviewing the following page:

BCBST's EEO Policies/Notices

BlueCross BlueShield of Tennessee is not accepting unsolicited assistance from search firms for this employment opportunity. All resumes submitted by search firms to any employee at BlueCross BlueShield of Tennessee via-email, the Internet or any other method without a valid, written Direct Placement Agreement in place for this position from BlueCross BlueShield of Tennessee HR/Talent Acquisition will not be considered. No fee will be paid in the event the applicant is hired by BlueCross BlueShield of Tennessee as a result of the referral or through other means.