Information Security GRC Analyst - Sugar Land or Lubbock

External Applicants: Please apply through Prosperity Bank's Career Center at https://www.prosperitybankusa.com/Careers . Applying through any other source may prevent Prosperity from receiving your application. Internal Applicants: If you are a current associate of Prosperity Bank, please apply through the internal Talent - Career Center in ADP. Prosperity Bank is an Equal Opportunity Employer. POSITION PURPOSE The Information Security Governance, Risk, and Compliance (IS GRC) Analyst is responsible for supporting the execution of the Bank's Information Security Governance, Risk, and Compliance program. This role performs and supports information security governance, cyber risk management, policy and standards administration, regulatory compliance, third-party cybersecurity risk management, control framework activities, audit and examination support, risk exception processes, remediation tracking, and security metrics and reporting. Working closely with the IS GRC Manager, Lead IS GRC Analyst, Enterprise Risk Management (ERM), Information Technology (IT), Vendor Management (VM), Human Resources (HR), Internal Audit (IA), Legal, Compliance, Procurement, and business stakeholders, the IS GRC Analyst supports the implementation, administration, and continuous improvement of information security governance processes and controls. The role assists with security risk assessments, control evaluations, third-party cybersecurity risk management activities, audit and examination support, risk exception administration, remediation tracking, and security reporting while helping ensure alignment with applicable laws, regulations, industry frameworks, and organizational requirements. This position reports directly to the IS GRC Manager. ESSENTIAL FUNCTIONS AND BASIC DUTIES Support day-to-day execution of the Bank's IS GRC program and related governance, risk, compliance, and reporting activities. Assist with the administration and maintenance of Information Security policies, standards, procedures, control documentation, and governance processes. Conduct and document information security risk assessments, control evaluations, and risk analyses for technology solutions, business initiatives, third parties, and other assigned activities. Support the Information Security risk register by documenting identified risks, remediation activities, treatment decisions, status updates, and supporting evidence. Support the Security Exception and Risk Acceptance process by collecting information, documenting compensating controls, tracking mitigation activities, and preparing management reporting. Support Information Security compliance and control framework activities, including assessments and reporting related to the CRI Profile, NIST CSF, NIST Special Publications, CIS Critical Security Controls, FFIEC guidance, and other applicable standards. Support internal audits, external audits, regulatory examinations, independent assessments, and control reviews by gathering evidence, preparing documentation, tracking responses, and monitoring remediation activities. Conduct third-party cybersecurity risk management activities, including cybersecurity due diligence reviews, inherent risk assessments, assurance evidence reviews, issue tracking, and ongoing monitoring. Analyze cybersecurity, GRC, risk, control, and third-party risk data to identify trends, control weaknesses, concentrations, emerging risks, and opportunities for program improvement. Assist with the development and reporting of KRIs, KPIs, security metrics, dashboards, and management reports. Monitor emerging cybersecurity threats, regulatory developments, control framework changes, and industry practices and escalate relevant observations as appropriate. Communicate security risks, control issues, findings, recommendations, and status updates clearly to technical and non-technical stakeholders. Build and maintain effective working relationships with Information Technology, Enterprise Risk Management, Vendor Management, Compliance, Legal, Procurement, Internal Audit, and business stakeholders. The above statements describe the general nature and level of work only. They are not an exhaustive list of all required responsibilities, duties, and skills. Other duties may be added, or this job description may be amended at any time. SUPERVISORY RESPONSIBILITIES: This position does not have direct supervisory responsibilities. QUALIFICATIONS Education/Certification: Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, a related discipline, or the equivalent of combined education and related work experience. Professional certifications such as CISSP, CRISC, CGRC, CISA, Security+, or equivalent certifications are preferred. Experience Required: Minimum of 2 years of experience in information security, cybersecurity governance, risk management, compliance, information technology auditing, or a related field. Experience supporting information security governance, risk management, compliance, control assessment, audit, examination, or third-party cybersecurity risk management activities. Experience applying information security and risk management frameworks and standards, including the Cyber Risk Institute (CRI) Profile, NIST Cybersecurity Framework (CSF), FFIEC guidance, CIS Critical Security Controls, ISO standards, or similar industry frameworks. Experience conducting security risk assessments, control evaluations, risk analyses, remediation tracking, security exception reviews, or related governance and risk management activities. Experience supporting internal audits, external audits, regulatory examinations, compliance initiatives, or independent assessments. Experience reviewing and assessing cybersecurity controls, policies, procedures, third-party security documentation, or related assurance evidence. Experience creating, maintaining, or supporting policy, standard, procedure, governance, or risk management documentation. Demonstrated ability to successfully execute assignments and initiatives in a complex and highly regulated environment. Experience with GRC platforms, workflow automation, reporting, or data analysis tools preferred. Banking or financial services industry experience strongly preferred. Required Knowledge: Knowledge of information security governance, policy management, risk management, compliance, control assessment methodologies, and accountability structures. Knowledge of information security control design, implementation, testing, and effectiveness assessment across governance, operational, and technical domains. Knowledge of risk-based control assessment and testing techniques, including evidence evaluation, validation, documentation, and quality review. Working knowledge of banking cybersecurity regulatory expectations and industry frameworks, including NIST, FFIEC, GLBA, and applicable state and federal requirements. Knowledge of the CRI Profile, NIST Cybersecurity Framework (CSF), NIST risk management publications, CIS Critical Security Controls, and recognized cybersecurity control frameworks. Knowledge of cybersecurity threats, vulnerabilities, attack techniques, technology risks, and risk assessment methodologies sufficient to evaluate control adequacy and business impact. Broad knowledge of enterprise technology and security architecture sufficient to assess risks across infrastructure, applications, cloud services, identity, data, and security technologies. Knowledge of third-party and cybersecurity supply-chain risk management, including due diligence, contractual controls, assurance reviews, monitoring, concentration risk, and exit considerations. Knowledge of cyber resilience, business continuity, disaster recovery, backup, dependency, and recovery control concepts. Knowledge of cybersecurity metrics, KRIs, control performance measures, governance reporting, GRC platforms, dashboard development, and data analysis techniques. Working knowledge of privacy a

View and apply on HireChats