If you are motivated and believe in the credit union philosophy of "People Helping People," join our team!
Position Overview: The IT GRC Analyst II assess, tests, documents, and monitors the SECU technology ecosystem to ensure the IT control environment effectively mitigates risks associated with an everchanging threat landscape. The IT GRC Analyst will possess a wide range of technical and interpersonal skills to bridge the gap between technology organizations and the business. Must have a big-picture perspective, ability to execute end-to-end risk management processes, and ability to quickly establish trust and build productive relationships across multiple departments. The IT GRC Analyst will require expertise to perform technology risk assessments, provide input to and/or document IT policies, standards, and guidelines, develop, monitor, and track risk remediation plans, and aggregate and report key risk metrics to senior stakeholders.
Responsibilities:
20% Identify, document, and monitor technology risks present across both internal and external (vendor / cloud) environments
20% Quantify inherent and residual IT risk levels to enhance analytics, inform prioritizations, and for use in management reporting
20% Work with risk remediation owners to establish remediation plans with milestones and target dates, and monitor progress towards remediation, escalating as appropriate
20% Execute technology risk management processes and provide input to support continuous improvement of process and program design
10% Perform risk and controls assessments while aggregating reporting for Audit and/or Regulatory issues.
10% Partner with relevant stakeholders to establish clear and consistent IT risk reporting, metrics, KRIs, and KPIs to inform decision making
Required Relevant Experience: Minimum 5 years
Required Knowledge, Abilities, Skills:
Teamwork, collaboration, self-driven and effective communication skills - both written and verbal.
5 years of IT Security and/or IT Risk Management experience working in a mid-to-large size company
Basic proficiency or ability to learn one or more of the following:
Risk and controls assessments
Documenting and maintaining IT Policies / Standards
IT Risk aggregation, reporting, KPI/KRIs
Issues management
Third party risk management
Working knowledge of various industry security standards and frameworks including: NIST, ISO 27001, ISF Standard of Good Practice (SoGP), etc.
Desired Knowledge, Abilities, Skills:
5+ years working in a financial institution.
Knowledge of modern enterprise and security architectures, their challenges, common approaches to overcome their challenges, and their inherent security strengths and weaknesses.
Professional certifications such as: CISSP, CISA, CISM, GIAC, CGEIT, CRISC, OSCE, or other relevant industry certification
Experience working within a DevOps environment
SECU provides equal employment opportunity to all qualified persons regardless of race, color, religion, age, sex, sexual orientation, gender identity, national origin, genetic information, disability, veteran status, or other classification protected by law.
Disclaimer
State Employees' Credit Union reserves the right to fill this role at a higher/lower level based on business need.
Skills Required
- Minimum 5 years of IT Security and/or IT Risk Management experience in a mid-to-large company
- Working knowledge of industry security standards and frameworks (NIST, ISO 27001, ISF SoGP)
- Teamwork, collaboration, self-driven attitude, and effective written and verbal communication skills
- Ability to perform risk and controls assessments
- Ability to document and maintain IT policies and standards
- IT risk aggregation, reporting, and KPI/KRI development
- Issues management and tracking remediation plans with milestones and escalation
- Third-party (vendor) risk management
- Experience working in a financial institution (5+ years)
- Professional certifications such as CISSP, CISA, CISM, GIAC, CGEIT, CRISC, OSCE
- Experience working within a DevOps environment
SECU Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about SECU and has not been reviewed or approved by SECU.
-
Retirement Support — Immediate 100% vesting and a 200% employer match on employee 401(k) contributions from 1–5% of pay (up to a 10% employer match) stand out. This level of support is described as unusually rich among financial‑services employers.
-
Leave & Time Off Breadth — 11 paid holidays plus 16 floating‑holiday hours, paid parental and caregiver leave, bereavement and volunteer time, and PTO that can reach 32 days per year with carryover up to 280 hours. These provisions provide predictable time off and flexibility across life events.
-
Healthcare Strength — Medical (PPO or HDHP) with HSA/FSA options, dental including a minor‑child orthodontia option, and vision are available for employees and eligible dependents. Employer‑paid basic life/AD&D and short‑term disability, with subsidized long‑term disability, add robust income protection.
SECU Insights
What We Do
Even though we're North Carolina's largest credit union, we're still just "people helping people." We currently serve over 2.6 million members through more than 270 branch offices - and growing! Members have 24/7 access to account services from over 1,100 ATMs, as well as via phone, our website, and the SECU Mobile App. Since 1937, we've provided financial services to employees of the State of North Carolina, public boards of education, and employees of associations formed for the benefit of State employees, as well as their immediate family members. We are the trusted provider of financial services for millions of members. And, according to Forbes Magazine, we're the best credit union in North Carolina. State Employees' Credit Union (SECU) is an Equal Housing Opportunity lender and federally insured by NCUA. SECU provides equal employment opportunity to all qualified persons regardless of race, color, religion, age, sex, sexual orientation, gender identity, national origin, genetic information, disability, veteran status, or other classification protected by law.
.png)
