> Markdown version of [/jobs/ext/581675-senior-analyst-grc](https://www.wearedevelopers.com/jobs/ext/581675-senior-analyst-grc). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Analyst, GRC - **Company:** Black & Veatch Holding Company - **Location:** Overland Park, KS, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Cyber Security, Information Systems, Data Security, IT Management, Cyber Threat Analysis, Information Technology, Data Analytics, RSA Archer Platform, Servicenow - **Published:** June 21, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=62160c9b3d4ff6a2 ## About the Role Do you have experience in Data-driven problem-solving?, Do you have a Bachelor's degree?, 7-10 years of experience in GRC executing or auditing against standards, frameworks, and industry regulations Demonstrated experience supporting GRC functions for global companies Solid proficiency in risk assessment methodologies and frameworks Proven ability to assess alignment of internal policy, process, control design and operations, and cyber risk management with regulatory standards and frameworks Strong collaboration with IT teams Familiarity with industry standards and frameworks (e.g., NIST CSF and supporting SP's, ISO 27001, AICPA SOC) Working knowledge of cyber and privacy laws and regulations Solid understanding of information security principles and concepts Strong desire to create task and functional efficiencies through use of technology and tools, especially GenAI Strong analytical, organizational, and communication skills Professional certifications such as CRISC, CISSP or others Experience with ServiceNow Risk Management platform Knowledge of FAR, DFARS, CMMC Experience with GRC platforms and risk management methodologies Ability to work independently and collaboratively as required Minimum Qualifications Bachelor's degree in Information Systems, Computer Science or a related field, or relevant years of experience to substitute for a degree. 2-3 years of experience in a GRC role All applicants must be able to complete pre-employment onboarding requirements (if selected) which may include any/all of the following: criminal/civil background check, drug screen, and motor vehicle records search, in compliance with any applicable laws and regulations. Work Environment/Physical Demands ## Description The Sr. Analyst, Governance, Risk, and Compliance (GRC) plays an important role in the GRC delivery framework, ensuring Black & Veatch's compliance with contractual and regulatory requirements, assessing control design and operation against common standards and frameworks, and assisting with third-party/supply chain risk management. The candidate will also promote a culture of risk awareness across the enterprise among other responsibilities. With an emphasis on cyber, contract and regulatory compliance risk management, the ideal candidate should be able to contribute to measuring success and identifying improvement opportunities and capabilities development in these areas. This role is ideal for a detail-oriented professional with a passion for cyber and compliance risk management who is comfortable operating independently. Independent and critical thinking is absolutely necessary to be successful in this role as is a desire to drive efficiencies in function delivery and day-to-day tasks. Key Responsibilities Contract Risk Management Proven experience reviewing client contract provisions related to data security, breach reporting, cyber resilience, and compliance certifications and measuring compliance in IT and security architecture and operations. Regulatory Compliance Risk Management Support independent certification and audit by working with D&IT peer groups and lines of business to collect documentation and evidence of security policies and operations Request and review documentation and evidence from control owners to certify and validate compliance to standards and industry-accepted best practice Monitor regulatory and legal landscape at a global scale and across market sectors and maintain awareness of compliance requirements IT Governance Act as an informed voice in development of policy and ensure alignment with regulatory, legal, and contractual requirements Assist establishment and enforcement of standards of practice documentation to be referenced by architecture and operations teams Contribute process and subject matter expertise in governance forums and cross-functional committees Cyber Risk Management Support establishment, collection, and ongoing improvement of metrics to measure effectiveness of cyber risk management and provide data-driven insight to decision makers and control owners Collaborate with peer D&IT groups to collect KPI's, KRI's and drive efficiency through automation and other means Supplier/Third Party Risk Management Contribute subject matter expertise through third party risk assessment process Identify and communicate risk of vendor engagements and mitigation actions to business owners and D&IT stakeholders Assist review of client security requirements in contracts and aggregate relevant clauses to inform contractual risk Miscellaneous: Assist development of user training aligned with cyber threat landscape, establish and implement metrics, and propose enhancements Support internal audit Assist with security certification/attestations/audits to demonstrate control effectiveness to independent service auditors/assessors and C3PAO's Assist in development of risk treatment plans and monitoring progress of actions. Collaborate with members of the GRC team to ensure timely and quality deliverables to internal and external customers Contribute subject matter expertise in review and response to internal and external sourced GRC related requests Management Responsibilities Individual Contributor ## Related Videos - [Forecasting Cyber Attacks with Glassdoor Reviews - Lianne Potter](https://www.wearedevelopers.com/videos/2143-forecasting-cyber-attacks-with-glassdoor-reviews-lianne-potter) - [Crypto-secure Data Management with In-Database Blockchain](https://www.wearedevelopers.com/videos/632-crypto-secure-data-management-with-in-database-blockchain) - [Applying Agile Principles to Incident Management ](https://www.wearedevelopers.com/videos/101-applying-agile-principles-to-incident-management) - [Your Manager Doesn’t Come with a User Manual (But You Can Totally Write One)](https://www.wearedevelopers.com/videos/1495-your-manager-doesn-t-come-with-a-user-manual-but-you-can-totally-write-one) - [How to govern Vibe Coding for the Enterprise](https://www.wearedevelopers.com/videos/100290-how-to-govern-vibe-coding-for-the-enterprise) - [Robots are coming into the wild! Full-Stack Robotics Engineers, be ready!](https://www.wearedevelopers.com/videos/479-robots-are-coming-into-the-wild-full-stack-robotics-engineers-be-ready) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Should senior developers refuse interview coding challenges?](https://www.wearedevelopers.com/magazine/29-should-senior-developers-refuse-interview-coding-challenges) - [A Guide to Green Tech and Green IT Careers](https://www.wearedevelopers.com/magazine/374-a-guide-to-green-tech-and-green-it-careers)