> Markdown version of [/jobs/ext/3023128-lead-security-analyst-grc](https://www.wearedevelopers.com/jobs/ext/3023128-lead-security-analyst-grc). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead Security Analyst - GRC

- **Company:** CollectiveHealth, Inc.
- **Location:** Lehi, UT, United States
- **Experience:** Expert
- **Salary:** $172,500.0 - $215,625.0
- **Contract:** Permanent contract
- **Skills:** Cloud Engineering, Cyber Security, Smartsuite, Data Management
- **Published:** September 21, 2026
- **Apply:** https://www.careerbuilder.com/job-details/lead-security-analyst-grc-lehi-ut--6f561907-5083-4667-972f-34cac3212ed0

## About the Role

8+ years in cybersecurity, GRC, audit, or risk/compliance roles.Experience managing SOC 2 / HITRUST audits, especially in cloud-native environments.Strong working knowledge of security frameworks and regulatory requirements.Demonstrated policy, data management, and risk mitigation capabilities.Familiarity with GRC tools and audit processes.Excellent communication and cross-functional collaboration skills.

Preferred (Nice to Haves):

Big 4 accounting firm background.Professional certifications: CISSP, CISA, CRISC, CISM, or similar.

## Description

As our Lead Security Analyst - GRC, you'll lead initiatives that address the company's-and some of our industry's-most sophisticated and meaningful security engineering challenges. You will build relationships across all parts of the business and drive multi-functional initiatives to continuously improve our security and privacy posture. You will be responsible for building and implementing controls that can scale and optimize as we move into a context-aware security environment.

What you''ll do:

Governance & Compliance:

Evaluate and implement security controls based on frameworks such as NIST, CIS, HIPAA, SOC 2, and HITRUST.Develop and maintain policies, procedures, and documentation (controls, narratives, matrices).Lead SOC 2 and HITRUST audit engagements, from audit planning through remediation.Coordinate and monitor third-party risk assessments and compliance reviews.Own and lead BCP (Business Continuity Planning) and BIA (Business Impact Assessments) efforts.Build and maintain security risk registry

Audit & Risk Management:

Perform audit readiness assessments, and support internal/external audits.Partner with external auditors, control owners, and leadership to minimize business disruption.Track and drive remediation plans based on audit findings and compliance gaps.Maintain and communicate exception documentation for policy deviations.Educate and guide control/risk owners on their responsibilities.

Advisory & Communication:

Act as a liaison between technical and non-technical stakeholders.Respond to security questionnaires, RFIs, and client compliance inquiries.Develop and deliver security awareness and training programs.Provide executive reporting on program status, risks, and overall health.


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [It's all about the Data](https://www.wearedevelopers.com/videos/425-it-s-all-about-the-data)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [The Data Mesh as the end of the Datalake as we know it](https://www.wearedevelopers.com/videos/156-the-data-mesh-as-the-end-of-the-datalake-as-we-know-it)
- [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Data Analyst Salary in Switzerland](https://www.wearedevelopers.com/magazine/276-data-analyst-salary-in-switzerland)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk)
- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)