Senior Cybersecurity GRC Analyst

REPAY (“Realtime Electronic Payments” / NASDAQ TICKER: RPAY) is an established and fast-growing publicly traded financial technology and payment processing company headquartered in Atlanta, Georgia, with offices across the country. REPAY enables its customers to accept payments anytime, anywhere, and through any channel while providing a secure, seamless, and enjoyable payment experience for the end consumers. The scalability of its products allows merchants of all sizes to add an instant arsenal of intelligent payment technology solutions to their businesses without significant development costs or infrastructure investments.

We are seeking a proactive and detail-oriented

Senior Cybersecurity GRC Analyst

with expertise in Governance, Risk, and Compliance (GRC) and a strong emphasis on

tool automation

. The ideal candidate will have extensive experience in GRC tool automation, Identity Governance and Administration (IGA) implementation, and security compliance. Reporting directly to the

Manager of Cybersecurity GRC

, this position plays a key role in strengthening the tools and automation that support the company’s governance, risk, and compliance programs. This role will focus on improving and optimizing the current security technology stack, including GRC tool automation, Identity Governance and Administration (IGA) implementation, phishing program effectiveness, and Trust Center management.
Governance and Compliance:

~ Partner with stakeholders to design, document, and enforce security policies, standards, and controls.

~ Automate the collection, validation, and continuous monitoring of control evidence from source systems and platforms, reducing manual evidence requests and keeping evidence current.

~ Automate and present risk reports and dashboards for senior management, delivering actionable insights into organizational risk posture and compliance.

~ Work closely with the corporate compliance team to handle cybersecurity questionnaires from clients.

~ Improve and automate the process of handling client questionnaires related to cybersecurity.

~ Act as a subject matter expert during client and regulatory discussions, providing expertise on GRC and risk management topics.

~ Collaborate with platform owners and stakeholders to implement controls and security best practices.

Drive improvements to the current cybersecurity and GRC technology stack by identifying gaps, redundancies, and integration opportunities, then recommending and implementing enhancements.

~ Automate GRC workflows within existing GRC platforms, including control testing, evidence collection, policy attestations, risk register updates, and compliance reporting.

~ Lead or support Identity Governance and Administration (IGA) implementation and optimization, including access certifications, role-based access, joiner/mover/leaver workflows, and segregation of duties controls that support SOX, SOC 2, and PCI-DSS requirements.

~ Support the phishing program, including simulation and awareness campaigns, user-reported phishing triage, and effectiveness metrics that feed into risk reporting.

~ Build integrations and automated data flows between GRC, IGA, ticketing, and security tools (via APIs, scripting, or low-code) to reduce manual effort and improve data quality.

~ Develop business cases, roadmaps, and success metrics for tooling improvements, and track adoption and return on investment.

~ Own and enhance the customer-facing Trust Center, keeping security documentation, certifications (e.g., SOC 2), policies, and standard questionnaire responses to current, and streamlining customer access requests.

Bachelor’s degree in computer science, Information Systems, or related field.
Cybersecurity certifications (e.g., 3+ years of experience in GRC roles, including hands-on GRC tool implementation and automation, preferably within technology organizations in financial services or related industries.

~ Hands-on experience supporting security compliance programs and the tools behind them across on-premises and cloud environments.

~ Experience managing projects, including timelines, resources, and stakeholder coordination.

~ Hands-on experience automating GRC processes and workflows within GRC platforms, such as control testing, evidence collection, and risk and compliance reporting.

~ SailPoint, Saviynt, Okta Identity Governance, Microsoft Entra ID Governance), including access reviews and identity lifecycle workflows.

~ KnowBe4, Proofpoint, Microsoft Defender for Office 365).

~ Experience managing or implementing a customer-facing Trust Center (e.g., SafeBase, Conveyor, Vanta Trust Center) to share security posture and compliance documentation with customers.

Strong understanding of SOX, AICPA SOC 1 and SOC 2, PCI-DSS compliance, and cybersecurity frameworks such as NIST CSF and NIST SP800-53.

~ Proficiency with GRC tools such as Hyperproof, Archer, ServiceNow or similar platforms, including configuring workflows and automations.

~ Python, PowerShell), or low-code tools to integrate and automate security and GRC platforms.

~ Strong understanding of software development practices and cloud environments to build credibility with technical teams.

~ Advanced expertise in Microsoft Excel and other office tools.

~ Proficiency in risk identification within technology solution architecture and design.

~ Ability to create and present actionable risk reports and dashboards for senior leadership.

Self-motivated and focused on continuous improvement, bringing solutions and taking ownership of outcomes.

~ Pragmatic approach, considering broader business contexts and competing priorities.

~ Collaborative mindset with the ability to work effectively across diverse teams such as Engineering, IT Operations, Security, and Compliance.

As the industry-leading financial technology provider in the Consumer Finance and Business to Business spaces, we continue to set the standard for application development and delivery. In 2019, REPAY became a public company listed on the Nasdaq Stock Market (RPAY). For the past three consecutive years, we have placed on the ACG® Atlanta Georgia Fast 40, a list recognizing the top 40 fastest-growing middle-market companies in Georgia. Our dedication to frequent, transparent communication is shown with companywide meetings where our leaders share company vision and encourage employees to ask questions.
We offer it all: business to casual dress, great snacks & beverages, and open-air collaborative team settings. Making a difference in our local communities – we support several philanthropic initiatives every year to give back to our local communities. We are self-driven, motivated professionals who do not require micro-management to ensure we produce high quality and timely work.
We create highly sophisticated payment processing applications and are always pushing the boundaries of what is possible. We are constantly revolutionizing the industry by building on new ideas from clients and employees. We provide the resources necessary to ensure new innovations can develop quickly and with quality. We offer a comprehensive benefits package which includes 100% coverage of employee healthcare premiums and several free benefits, including life insurance, disability insurance, and work-life balance resources. Our employees’ futures are important to us, which is why we have a 401(k)-employer match and and an Employee Stock Purchase Plan. REPAY employees are eligible to participate in our Annual Bonus Program. This bonus award reflects excellent performance of individual contributions and goals achieved during the past year.
REPAY is an Equal Opportunity Employer and we promote a company culture where diversity, equity and inclusion are central. We are committed to build our teams and grow a company in which employees can succeed, regardless of race, color, national origin, sex, sexual orientation, gender identity or expression, transgender status, pregnancy, religion, age (40 and over), disability, service in the uniformed services, protected veteran status, genetic information, or any other classification protected by federal, state or local law. Additionally, we are not able to sponsor visas.