Lead Security Analyst, Governance Risk Compliance

What’s Under the Hood DriveTime Family of Brands is the largest privately owned used car sales finance & servicing company in the nation. Headquartered in Tempe, Arizona and Dallas, Texas, we create opportunities and improve the lives of our customers and our employees by placing a focus on putting the right customer, in the right vehicle, on the right terms and on their path to ownership. The DriveTime Family of Brands spans across DriveTime, Bridgecrest and SilverRock.  You can find us at the intersection of technology and innovation as we use our proprietary tools and over two decades of industry knowledge to redefine the process of purchasing, financing, and protecting your vehicle.  That’s Nice, But What’s the Job? In short, you’ll serve as a senior-level technical risk leader within the Information Security Governance, Risk & Compliance (GRC) function. In this role, you'll independently lead complex cybersecurity risk assessments across applications, infrastructure, cloud environments, identity platforms, data protection controls, and business processes. You'll help strengthen and mature the organization's risk management program by developing standardized assessment methodologies, guiding risk treatment decisions, supporting compliance and audit initiatives, leading third-party assessments, and mentoring other GRC professionals. This position requires a strong blend of technical cybersecurity knowledge, business risk acumen, and the ability to influence stakeholders across the organization. In Long, as the Lead GRC Analyst, you will be responsible for: Leading complex Information Security risk assessments across applications, infrastructure, cloud, identity, data, and business processes, including threat identification, control evaluation, likelihood and impact analysis, risk scoring, treatment planning, documentation, tracking, and reporting. Developing, standardizing, and enhancing cybersecurity risk assessment methodologies, control evaluation frameworks, documentation standards, risk scoring models, and management reporting processes. Leading assigned GRC services and initiatives including compliance monitoring, policy governance, audit support, third-party security assessments, due diligence activities, and related risk management processes. Providing technical risk management leadership, subject matter expertise, quality reviews, process improvement recommendations, and mentorship to other analysts. Independently assessing technical security findings, vulnerabilities, and compensating controls to develop clear risk statements and actionable treatment recommendations. Evaluating business impacts, identifying material cybersecurity risks, and preparing risk acceptance or remediation recommendations for management decision-making. Conducting control assessments against applicable policies, standards, regulatory obligations, contractual requirements, and industry frameworks while tracking remediation and recurring issues. Leading third-party cybersecurity assessments and partnering with Vendor Management, Legal, Compliance, Technology, and business stakeholders to identify and address security risks. Coordinating and developing responses to cybersecurity due diligence questionnaires, customer security reviews, external assessments, insurance inquiries, and related requests. Supporting and improving Information Security policy governance through drafting, reviewing, updating, and maintaining policies, standards, and related documentation. Owning or supporting Information Security awareness and education initiatives, including communications, training content, campaign development, program metrics, and continuous improvement efforts. Serving as the primary owner for assigned GRC services and risk management processes by establishing procedures, metrics, governance routines, and accountability frameworks. Mentoring GRC Analysts and promoting consistent, high-quality risk assessment and reporting practices throughout the organization. Performing other duties as assigned. So What Kind of Folks Are We Looking For? Strong technical understanding of cybersecurity threats, vulnerabilities, attack vectors, and security controls across identity, network, endpoint, application, cloud, and data security domains. Ability to independently assess technical risks, identify control gaps, evaluate compensating controls, and determine practical risk treatment strategies. Strong analytical and critical thinking skills with the ability to challenge assumptions, prioritize risks, and make sound risk-based recommendations. Exceptional written and verbal communication skills with the ability to translate complex technical risks into business-focused recommendations. Strong organizational and project management skills with the ability to manage multiple concurrent initiatives and assessments. Ability to influence and collaborate effectively with technical and non-technical stakeholders without direct authority. Demonstrated ability to improve processes, methodologies, reporting capabilities, and governance practices. Strong attention to detail and commitment to producing high-quality risk assessments, documentation, and reporting. Ability to mentor and develop less experienced team members while fostering collaboration and continuous improvement. Comfortable navigating ambiguity and driving results in a dynamic, evolving cybersecurity environment. The Specifics. 7+ years of relevant experience in Information Security, cybersecurity risk management, security engineering, security architecture, IT risk, IT audit, or a related discipline. 3+ years of experience independently leading technical cybersecurity risk assessments. Demonstrated experience assessing applications, infrastructure, cloud environments, identity solutions, or other technical systems and evaluating associated security controls and threat scenarios. Experience developing risk statements, condu