- Company Name
- Capital Bank, N.A.
- Job Title
- Information Security - GRC/Privacy Analyst
- Job Description
-
**Job Title:** Information Security – GRC/Privacy Analyst
**Role Summary:**
Lead governance, risk, and compliance (GRC) functions focused on information security and privacy. Manage risk assessments, policy development, and regulatory compliance across IT and business units to protect digital assets and ensure adherence to industry and government standards.
**Expectations:**
- Maintain and improve security posture within a regulated financial environment.
- Deliver actionable insights to stakeholders and drive continuous improvement of controls and processes.
- Respond promptly to incidents, investigations, and audit findings.
**Key Responsibilities:**
- Conduct gap analyses and implement frameworks (PCI‑DSS, GLBA, NIST, SOX, CRI, Reg P).
- Develop, update, and enforce policies, standards, and guidelines.
- Perform vendor risk assessments and enforce security requirements.
- Oversee data privacy practices, monitor regulatory changes, and promote ethical behavior.
- Execute regular security assessments, penetration testing, and vulnerability remediation.
- Manage identity and access management procedures.
- Participate in incident response, business continuity planning, and audits.
- Monitor network traffic and logs via XDR; prioritize and remediate threats.
- Collaborate with cross‑functional teams to embed controls into processes and conduct security awareness training.
**Required Skills:**
- Analytical, problem‑solving, and risk‑assessment abilities.
- Knowledge of regulatory frameworks (PCI‑DSS, GLBA, NIST, SOX, Reg P, CRI).
- Experience with GRC tools (ServiceNow, Process Unity, AuditBoard, Tandem).
- Proficiency in Microsoft 365 Security & Compliance Centers, Office suite.
- Strong communication, collaboration, and stakeholder‑management skills.
- Ability to work independently and within multidisciplinary teams.
**Required Education & Certifications:**
- Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or related field.
- Minimum 3 years of experience in information security, privacy, or related regulatory role (preferably in finance).
- Certifications such as CISA, CISSP, CRISC, CompTIA Security+, or equivalent.