Enterprise GRC Analyst

About This Role

The Enterprise Security GRC Analyst supports the governance, risk, and compliance (GRC) program for the Franklin County Data Center (FCDC) and the county agencies it serves. The role covers third-party risk management, security awareness, information security policy and governance, and aligning FCDC and the county to the NIST Cybersecurity Framework (CSF) 2.0 as part of compliance with Ohio Revised Code (ORC) 9.64. The analyst reviews vendor products, services, and documentation, identifies and measures the risks they carry, and reports those risks with recommendations to mitigate them to FCDC leadership, partners, and vendors. The analyst also gathers technical and business needs from county agencies and FCDC teams and helps turn them into policies, standards, and governance.

Responsibilities

• Conduct security reviews of new hardware and software procurements for FCDC and county agencies, including SaaS and cloud services, on-premises software, and network, endpoint, and connected devices
• Conduct security reviews of hardware and software renewals, reassessing the vendor’s security posture, changes in scope or data handled, and any open findings before the renewal is approved
• Review vendor responses and documentation (security questionnaires, SOC reports, certifications, architecture and data flow information), document controls in place and controls not in place, and engage the vendor, business contact, and leadership as appropriate to complete the assessment
• Serve as primary point of contact for vendors on security questionnaires, responses, and documentation
• Review, document, track, and collaborate on remediation of third-party deficiencies
• Work with procurement, finance, and agency contacts so security review is built into purchasing and renewal workflows and completed ahead of contract deadlines
• Recommend updates to vendor security assessment procedures, forms, RFI/RFP security requirements, questionnaires, security contract language templates, and vendor risk reporting and metrics
• Provide recommendations for vendor security scoring and help develop metrics for measuring

Requirements

• Eligible to work in the U.S. without sponsorship (U.S. citizens or green card holders only)
• Live within commuting distance of downtown Columbus, Ohio

Important Details

• Probationary period: 180 days for new employees or those promoted into new positions

About the Company

FCDC provides cost-effective, business-driven, collaborative, and secure IT services and solutions to public service agencies throughout Ohio’s most dynamic county. Its goals are to be the most trusted enterprise technology service provider for Franklin County and a national leader in digital government services. The FCDC team empowers local government departments, agencies, teams, and nonprofits to deliver top-notch services to residents and businesses in central Ohio.