IT GRC Privacy Analyst

Join the Bear Force as a IT GRC Analyst, where you’ll be at the forefront of defining how we manage risk, shape policy, and build a stronger, smarter IT ecosystem. We're seeking a hands-on, curious problem-solver who thrives on collaboration—partnering with IT and business teams to craft policies, strengthen controls, and keep our organization aligned with the highest standards of security and compliance.

• Design and drive risk assessment activities. Understand, assess, and formally articulate Security Risks, and develop IT and Security Policies, Standards and Guidelines
• Create and maintain strong working relationships with key business, legal, IT and other stakeholders throughout the company, while advancing our information security maturity via a standards and controls based approach.
• Partner with stakeholders in Supply Chain, IT, Security, Legal and Operations to develop and implement a Business Continuity Program
• Drive remediation action plans to ensure they are designed to mitigate security/privacy risks
• Support business and product release commitments by driving risk identification, mitigation and acceptance for unmitigated security risks with key partners in and outside of IT
• Consult with business or security partners on information security requirements and applicability to business processes, products, or services
• Focus on continuous improvement of operational processes and developing innovative and automated operational functionality - we're looking for someone who can help us level up

• A self-motivated and collaborative problem solver with ability to work in a dynamic environment
• 5+ years’ experience in Technical Security Governance, Compliance, Internal Audit in an IT environment
• Experience in using Microsoft Purview and GRC tools such as OneTrust
• Prior working with developing compliance metrics and benchmarks
• Familiarity with industry guidelines such as Common Vulnerability Scoring System (CVSS), ISF and regulatory compliance frameworks (NIST CSF, ISO27001, PCI, HIPAA)
• Background and understanding of global privacy regulation - GDPR, CCPA, PIPA, etc.
• Technical knowledge and understanding of infrastructure, including network segmentation, Zero Trust architecture, Identity and Access Management, CIS Benchmarks, Network Security, and Vulnerability Management
• Verbal and written communication skills strong enough to distill the above for a non-technical audience
• Possession of certifications such as CISA, CISM, CIPP, CISSP or other relevant certifications

Stanley is committed to a diverse and inclusive work environment. Stanley is an equal opportunity employer and does not discriminate based on race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status. For individuals with disabilities who would like to request an accommodation, please reach out to [email protected]. 

Stanley is a total rewards company, which includes rewards beyond base salary. At Stanley, full-time employees are eligible for an annual bonus, based on company and individual results. In addition, we offer a variety of employee benefits, personalized time off, 14-Paid holidays, dental, vision, 401(k), and much more.