Senior Cybersecurity GRC Analyst

At REPAY, the Senior Cybersecurity GRC Analyst plays a central role in strengthening how the organization manages compliance, risk reporting, and evidence workflows. Reporting to the Manager of Cybersecurity GRC, this position focuses on GRC tool automation, Identity Governance and Administration (IGA) implementation, and improving how security posture information is delivered to internal and external stakeholders.

This onsite role is based in Atlanta, GA and centers on integrating and automating evidence/control processes across systems, improving risk visibility for senior leadership, and keeping customer-facing trust materials up to date.

Responsibilities

• Partner with stakeholders to design, document, and enforce security policies, standards, and controls.
• Align security practices with NIST CSF, NIST SP800-53, PCI-DSS, and SOC 2.
• Automate the collection, validation, and continuous monitoring of control evidence from source systems and platforms to reduce manual evidence requests and keep evidence current.
• Map controls once to multiple frameworks so that a single automated evidence stream supports NIST CSF, PCI-DSS, SOC 2, and SOX requirements.
• Automate and present risk reports and dashboards for senior management to deliver actionable insight into organizational risk posture and compliance.
• Work closely with the corporate compliance team to support cybersecurity questionnaires from clients, and improve and automate the client questionnaire workflow.
• Serve as a subject matter expert during client and regulatory discussions across GRC and risk management topics.
• Collaborate with platform owners and stakeholders to implement controls and security best practices.
• Identify gaps, redundancies, and integration opportunities across the current cybersecurity and GRC technology stack, then recommend and implement enhancements.
• Automate GRC workflows within existing GRC platforms, including control testing, evidence collection, policy attestations, risk register updates, and compliance reporting.
• Lead or support Identity Governance and Administration (IGA) implementation and optimization, including access certifications, role-based access, joiner/mover/leaver workflows, and segregation of duties controls that support SOX, SOC 2, and PCI-DSS.
• Support the phishing program, including simulation and awareness campaigns, user-reported phishing triage, and effectiveness metrics feeding into risk reporting.
• Build integrations and automated data flows between GRC, IGA, ticketing, and security tools using APIs, scripting, or low-code approaches to reduce manual effort and improve data quality.
• Develop business cases, roadmaps, and success metrics for tooling improvements, and track adoption and return on investment.
• Own and enhance the customer-facing Trust Center by keeping security documentation, certifications (including SOC 2), policies, and standard questionnaire responses current, and streamlining customer access requests.

Requirements

• Bachelor’s degree in computer science, Information Systems, or related field.
• Cybersecurity certifications (e.g., CISSP, CISM, CISA) are a plus.
• 3+ years of experience in GRC roles, including hands-on GRC tool implementation and automation, preferably in technology organizations in financial services or related industries.
• Hands-on experience supporting security compliance programs and associated tools across on-premises and cloud environments.
• Experience managing projects, including timelines, resources, and stakeholder coordination.
• Hands-on experience automating GRC processes and workflows within GRC platforms, such as control testing, evidence collection, and risk and compliance reporting.
• Experience implementing IGA solutions (e.g., SailPoint, Saviynt, Okta Identity Governance, Microsoft Entra ID Governance), including access reviews and identity lifecycle workflows.
• Experience supporting phishing prevention, simulation, and response programs (e.g., KnowBe4, Proofpoint, Microsoft Defender for Office 365).
• Demonstrated ability to assess an existing security technology stack and drive measurable improvements through optimization, integration, and automation.
• Experience managing or implementing a customer-facing Trust Center (e.g., SafeBase, Conveyor, Vanta Trust Center) to share security posture and compliance documentation with customers.
• Strong understanding of SOX, AICPA SOC 1 and SOC 2, and PCI-DSS, as well as cybersecurity frameworks such as NIST CSF and NIST SP800-53.
• Proficiency with GRC tools such as Hyperproof, Archer, ServiceNow, or similar platforms, including workflow and automation configuration.
• Working knowledge of APIs, scripting (e.g., Python, PowerShell), or low-code tools to integrate and automate security and GRC platforms.
• Strong understanding of software development practices and cloud environments to build credibility with technical teams.
• Advanced expertise in Microsoft Excel and other office tools.
• Exceptional presentation and communication skills.
• Familiarity with reporting tools such as PowerBI or Sisense is a plus.
• Ability to identify risk within technology solution architecture and design.
• Ability to create and present actionable risk reports and dashboards for senior leadership.
• Demonstrated ability to drive cross-team collaboration and deliver impactful change.
• Self-motivated and focused on continuous improvement, with strong ownership of outcomes.
• Ability to operate independently and create or adapt processes to meet organizational needs.
• Analytical, pragmatic approach, including assessing problems, identifying root causes, and recommending solutions.
• Collaborative mindset to work effectively with Engineering, IT Operations, Security, and Compliance.

Technologies

• NIST CSF, NIST SP800-53, PCI-DSS, SOC 2, SOX
• GRC tool automation
• Identity Governance and Administration (IGA), SailPoint, Saviynt, Okta Identity Governance, Microsoft Entra ID Governance
• Hyperproof, Archer, ServiceNow
• APIs, Python, PowerShell, low-code tools, Scripting
• AICPA SOC 1
• Microsoft Excel, PowerBI, Sisense
• KnowBe4, Proofpoint, Microsoft Defender for Office 365
• Trust Center, SafeBase, Conveyor, Vanta Trust Center
• Role-based access, joiner/mover/leaver workflows, segregation of duties controls, access certifications

Benefits

• 100% coverage of employee healthcare premiums
• Life insurance
• Disability insurance
• Work-life balance resources
• 401(k) with employer match
• Employee Stock Purchase Plan
• Annual Bonus Program
• All benefits go into effect day one