APCO Holdings partners with dealerships across North America to deliver innovative vehicle protection products and services that enhance the ownership experience for customers and drive growth for our partners. Through our family of brands, we bring together industry expertise, technology, and data-driven insights to help dealers strengthen their finance and insurance performance and build lasting relationships with their customers.
Our teams work collaboratively across operations, technology, risk, finance, marketing, and sales to deliver solutions that create measurable value and support the continued growth of APCO and the partners we serve.
We are looking for a Senior Security Risk & Compliance Analyst to support and strengthen APCO’s security governance, risk, and compliance (GRC) initiatives. In this role, you will help drive compliance efforts, assess security controls, identify risks, and support the organization’s ongoing commitment to maintaining a strong security posture and regulatory compliance.
What You'll Do
- Support the planning, coordination, and execution of compliance audits, including readiness assessments and external audit engagements
- Partner with control owners to document, implement, and maintain compliance controls aligned control requirements.
- Collect, review, and validate audit evidence to ensure completeness and accuracy
- Track audit findings, exceptions, and remediation efforts through closure
- Act as a liaison between internal stakeholders and external auditors
- Perform internal audits and control assessments to evaluate the effectiveness of security and compliance controls
- Develop audit plans, testing procedures, and audit reports
- Identify control gaps and recommend remediation actions
- Monitor and track remediation efforts to ensure timely resolution
- Administer and maintain the organization’s GRC platform
- Configure audit workflows and maintain accurate, up-to-date due diligence responses within the GRC platform.
- Ensure data integrity and accuracy within the system
- Generate dashboards and reports for compliance status, audit tracking, and risk posture
- Maintain the enterprise risk register, including identification, classification, and documentation of risks
- Facilitate risk assessments with business and IT stakeholders
- Evaluate risk severity based on likelihood and impact
- Track risk treatment plans (remediation, acceptance, transfer, avoidance)
- Provide regular reporting on risk posture to leadership
- Collaborate with IT, Security, Legal, and business units to ensure alignment with compliance requirements
- Assist in the development and maintenance of security policies, standards, and procedures
- Support other compliance initiatives as needed (e.g., regulatory, customer security questionnaires)
Audit & Compliance
Internal Audit
GRC Platform Management
Risk Registration & Management
Governance & Cross-Functional Collaboration
Qualifications
- Bachelor’s degree in Information Security, Information Systems, or related field (or equivalent experience)
- At least 5 years of experience in security compliance, audit, or GRC
- Hands-on experience with SOC 2 audits and Trust Services Criteria and New York 23 NYCRR 500, or other regulatory compliance.
- Experience with performing internal audits and control testing
- Familiarity with GRC tools (e.g., ServiceNow GRC, Archer GRC)
- Strong understanding of risk management principles and frameworks
- Knowledge of common frameworks (e.g., AICPA SOC 2, ISO 27001, NIST)
- Experience with leading cybersecurity due diligence activities, including responding to customer and partner security questionnaires accurately and in a timely manner
- Strong analytical, organizational, and communication skills
Preferred Certifications
- Certified Information Systems Auditor (CISA) or
- Certified in Risk and Information Systems Control (CRISC) or
- Certified Information Systems Security Professional (CISSP)
This Role Might Be a Great Fit If You…
- Enjoy identifying risks and improving security processes
- Thrive in cross-functional, collaborative environments
- Like balancing technical security concepts with governance and compliance
- Are motivated by protecting systems, data, and organizational integrity
What We Offer
- Competitive compensation
- Comprehensive medical, dental, and vision benefits
- 401(k) with company match
- Paid time off and company holidays
- Opportunities for professional growth and certification support
- A collaborative and security-focused work environment
Skills Required
- Bachelor's degree in Information Security, Information Systems, or related field (or equivalent experience)
- At least 5 years of experience in security compliance, audit, or GRC
- Hands-on experience with SOC 2 audits and Trust Services Criteria and New York 23 NYCRR 500 or other regulatory compliance
- Experience performing internal audits and control testing
- Familiarity and hands-on experience with GRC tools (e.g., ServiceNow GRC, Archer GRC) and administering a GRC platform
- Strong understanding of risk management principles and frameworks (AICPA SOC 2, ISO 27001, NIST)
- Experience leading cybersecurity due diligence and responding to customer/partner security questionnaires
- Strong analytical, organizational, and communication skills
- CISA, CRISC, or CISSP certification
What We Do
APCO, established in 1984, is a leading marketer and administrator of extended vehicle service contracts, warranties, and other related products sold primarily by automobile dealers located throughout the United States. APCO has expanded its offerings over the last decade to include leading-edge training for dealership sales and finance teams. The company markets its products using the EasyCare and GWC brands, as well as other private label automobile manufacturer brands, through a network of independent agents and an internal salesforce that specialize in consulting with and servicing the automotive dealership markets. EasyCare and GWC Warranty are the only "Motor Trend Recommended Best Buy" brands in the automotive aftermarket. For further information about APCO, see www.gwcwarranty.com and www.easycare.com.
