> Markdown version of [/jobs/ext/2549566-sr-grc-analyst-hybrid](https://www.wearedevelopers.com/jobs/ext/2549566-sr-grc-analyst-hybrid). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Sr. GRC Analyst (Hybrid) - **Company:** Selective Insurance - **Location:** Hartford, CT, United States - **Experience:** Expert - **Salary:** $157,000.0 - **Contract:** Permanent contract - **Skills:** Software System Penetration Testing, Control Objectives for Information and Related Technology (COBIT), Cyber Security, Microsoft Office, Software Vulnerability Management, Tools for Reporting - **Published:** August 14, 2026 - **Apply:** https://diversityjobs.com/main/sendform/8/8/28176/1/17881526?backUrl=%2Fcareer%2F17881526%2FVulnerability-Management-Specialist-Grc-Hybrid-Connecticut-Hartford ## About the Role Required * Working understanding of cybersecurity, risk management, compliance, vulnerability management, audit, or third-party risk concepts. * Ability to evaluate common security evidence, identify incomplete or inconsistent information, and escalate potential risk concerns. * Strong attention to detail, documentation discipline, and ability to manage multiple assessment or remediation activities concurrently. * Clear written and verbal communication skills, including the ability to summarize technical or control information for business stakeholders. * Proficiency with Microsoft Office; experience with GRC, vendor risk, vulnerability management, ticketing, or reporting tools is preferred. Preferred * 3-5 years of experience in GRC, cybersecurity, third-party risk, vulnerability management, audit, compliance, procurement risk, or vendor management. * Experience contributing to audits, regulatory compliance activities, control testing, risk assessments, or vendor due diligence reviews. * Familiarity with frameworks and regulations such as NIST CSF, NIST 800-53, NYDFS, GLBA, SOX, SOC reporting, ISO 27001, or related standards. * Relevant certification or progress toward a certification such as CRISC, CISA, Security+, CDPSE, CTPRP, or similar is a plus. ## Description The Sr. GRC Analyst performs established governance, risk, compliance, vendor risk, and vulnerability management activities with increasing independence. This role is designed for a developing risk professional who can execute risk assessments, analyze control evidence, support regulatory and audit requirements, coordinate remediation tracking, and produce clear reporting for stakeholders. The role applies working knowledge of cybersecurity controls, risk frameworks, third-party due diligence, vulnerability governance, and issue management to support consistent, defensible risk decisions. Responsibilities GRC Program Execution * Execute assigned GRC activities, including risk documentation, control mapping, exception tracking, and assessment record maintenance. * Support policy, standard, and procedure lifecycle activities by coordinating updates, collecting input, and validating evidence of approvals. * Prepare materials for governance forums, risk reviews, audit discussions, and compliance reporting using established templates and data sources. Third-Party Risk Management * Coordinate vendor assessment intake, due diligence requests, follow-ups, and stakeholder communications through closure. * Review vendor questionnaires, SOC reports, ISO certifications, penetration test summaries, vulnerability information, business continuity documentation, and other due diligence artifacts for completeness and risk relevance. * Document assessment conclusions, remediation items, missing evidence, and residual risk considerations in alignment with defined TPRM procedures. Vulnerability Management Governance * Support vulnerability governance activities by tracking remediation status, exception requests, risk acceptance documentation, and aging issues. * Partner with technology and risk stakeholders to validate ownership, required evidence, and remediation progress for identified vulnerabilities or control gaps. * Contribute to recurring metrics and reporting related to vulnerability trends, overdue remediation, exception volume, and issue closure. Audit and Compliance Support * Collect, organize, and validate audit evidence in accordance with defined control objectives and regulatory expectations. * Assist with remediation tracking for audit findings, control gaps, risk acceptances, and compliance action items. * Maintain documentation aligned to frameworks and requirements such as NIST CSF, NIST 800-53, NYDFS, GLBA, SOX, SOC reporting, and ISO 27001. Metrics and Continuous Improvement * Maintain and enhance routine metrics for risk assessment volume, vendor status, vulnerability remediation, open issues, and documentation completeness. * Identify opportunities to improve templates, procedures, evidence requests, stakeholder instructions, and process consistency. * Support process improvement efforts by documenting pain points, recommending practical updates, and helping implement approved changes. ## Related Videos - [Minimising the Carbon Footprint of Workloads](https://www.wearedevelopers.com/videos/1198-minimising-the-carbon-footprint-of-workloads) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?](https://www.wearedevelopers.com/videos/100248-reporting-active-exploits-in-24-hours-are-you-ready-for-the-cra) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Should senior developers refuse interview coding challenges?](https://www.wearedevelopers.com/magazine/29-should-senior-developers-refuse-interview-coding-challenges) - [Résumé-Driven Development: How IT trends affect the job market for software developers](https://www.wearedevelopers.com/magazine/59-resume-driven-development-how-it-trends-affect-the-job-market-for-software-developers) - [Quick guide: How to write a Software Developer CV](https://www.wearedevelopers.com/magazine/37-quick-guide-how-to-write-a-software-developer-cv) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk)