Lead IT GRC Analyst (Policy Management)

The Lead IT GRC Analyst will lead the operational execution, integration, and continuous improvement of the Cyber Governance & Controls function. This role will support turning a broad portfolio of governance work including policies, standards, configuration baselines, Cybersecurity Risk Acceptance Memoranda, long-term governance models, control libraries, and governance advisory engagements into a coordinated, measurable enterprise service. The successful candidate will serve as the operational leader connecting Governance strategy to day-to-day execution. The role will partner across Cybersecurity, Operations & Technology, Legal, Privacy, Audit, Procurement, and various business stakeholders to establish clear ownership, decision rights, evidence, review cadences, exception paths, and sustainable control outcomes. This role enables delivery across eight connected service lines: policy and standards lifecycle management; security baselines and control governance; vendor security management; continuous third-party monitoring; GRC tooling and workflow automation; data protection governance; program governance advisory; and regulatory, audit, and standards interpretation. The position is differentiated from traditional project management by its accountability for the operating health, maturity, adoption, traceability, and effectiveness of Governance itself. Responsibilities Governance Operations Develop, implement, and continuously improve Governance operating procedures, playbooks, lifecycle schedules, decision records, and recurring operating rhythms. Coordinate policy forums, standards review, governance working sessions, steering decisions, escalations, action-item closure, and quarterly operating reviews. Serve as coordinator for the Global Cybersecurity Governance Steering Committee, including agenda planning, materials, stakeholder alignment, decision tracking, action-item follow-through, and governance reporting. Chair the Global Cybersecurity Governance Working Group, facilitating cross-functional discussion, driving alignment on governance priorities, escalating decisions as needed, and ensuring actions are assigned, documented, and completed. Define and maintain roles, decision rights, RACIs, reviewers, approvers, accountable service owners, evidence expectations, and exception paths across Governance services. Establish a consistent definition of done for governance outcomes spanning ownership, documented requirements, operational process, automation, monitoring, metrics, exceptions, and recurring review. Separate administrative, technical, and operational governance so that requirements are not only approved, but implemented, monitored, evidenced, and sustained. Policy, Standards, Baselines & Risk Acceptance Governance Operate the end-to-end lifecycle for cyber policies, standards, configuration baselines, procedures, and supporting guidance, including intake, drafting, stakeholder review, approval, publication, communication, maintenance, and retirement. Maintain the Cyber Policy Library, authoritative document hierarchy, review calendar, approval evidence, version history, control mappings, glossary, and publication quality controls. Coordinate development and renewal of Cybersecurity Risk Acceptance Memoranda, including validated current-state data, residual-risk statements, accountable owners, corrective-action plans, milestones, approval records, audit dependencies, reporting, and retirement criteria. Help transition broad, recurring risk acceptances toward targeted, risk-based exception and monitoring processes where sustainable ownership and evidence can be established. Support requirement-centric governance by mapping policies, standards, baselines, and controls to authoritative frameworks and identifying opportunities to automate governance workflows, document reviews, approval processes, and evidence collection. Service Management & Enablement Maintain the Cyber Governance & Controls service catalog, definitions, owners, RACIs, inputs, outputs, dependencies, intake paths, service levels, and records of authority. Coordinate operational visibility across policy and standards, control baselines, vendor security, continuous third-party monitoring, GRC tooling, data protection, governance advisory, and audit and standards interpretation. Develop and administer common intake, triage, prioritization, status, decision, escalation, evidence, and closure practices while preserving accountability with service owners. Measure demand, throughput, aging, adoption, quality, stakeholder experience, control effectiveness, and operational health across the Governance portfolio. Identify work already delivered through remediation and transformation programs and make it visible through consistent governance tagging, ownership, reporting, and sustainment criteria. Improve self-service through clear guidance, reusable patterns, decision trees, communications, training, and content structured for both people and AI-enabled assistants. Metrics, Reporting & Executive Communications Develop and maintain Governance metrics, key performance indicators, scorecards, and dashboards. Produce executive updates, quarterly operating reviews, and portfolio health reporting. Track strategic initiatives, risks, dependencies, decisions, maturity objectives, and service performance. Translate complex Governance information into clear, business-oriented insights and leadership materials. Governance Strategy & Transformation Support Support execution of the Cyber Governance & Controls maturation strategy across near-term stabilization, multi-year integration and automation, and continuous, intelligence-led governance. Convert time-bound remediation and transformation initiatives into sustainable business-as-usual governance with named owners, documented processes, preventive and detective controls, metrics, evidence, exception handling, and recurring review. Coordinate governance design for major programs such as Frontier AI, Attack Surface Management, identity and service-account governance, secure management-plane initiatives, high-risk travel, data protection, and third-party risk. Advance GRC modernization by defining authoritative systems of record and practical integration across ServiceNow IRM, LogicGate RiskCloud, Jira, risk hubs, policy repositories, dashboards, and evidence sources. Facilitate maturity assessments, current-state inventories, gap analysis, target operating models, governance gates, leadership decisions, roadmap milestones, and continuous-improvement plans. Partner with established program management teams while retaining ownership of Governance-specific operating models, service practices, metrics, decision rights, and enablement. Stakeholder Engagement Build productive partnerships across Cybersecurity, Operations & Technology, Legal, Privacy, Audit, Procurement, and various business stakeholders. Facilitate stakeholder alignment, decision-making, communications, and socialization for Governance initiatives. Support organizational change and adoption activities associated with new or revised Governance services and processes. Act as a central point of coordination for Governance operating information without replacing accountable service owners or enterprise program managers. Basic Qualifications 5+ years of experience in governance, risk management, compliance, cybersecurity operations, business operations, service operations, or a related discipline. Bachelor’s degree or equivalent relevant professional experience. Experience establishing and managing operating processes, governance frameworks, service management practices, or control environments. Experience developing executive reporting, scorecards, dashboards, and performance measures. Demonstrated ability to coordinate work across multiple stakeholders and functions in a complex organization. Exceptional written and verbal communication skills, with the ability to translate complex governance and cybersecurity topics into clear, audience-appropriate messages. Strong written, verbal, facilitation, analytical, and organizational skills. Desired Characteristics Experience supporting Governance, Risk and Compliance, cybersecurity, audit, third-party risk, or enterprise risk functions. Knowledge of governance frameworks, controls management, policy management, and enterprise operating models. Experience with ServiceNow IRM, LogicGate, Archer, Jira, or comparable governance and workflow platforms. Familiarity with frameworks and standards such as NIST, ISO 27001, PCI DSS, or CIS. Demonstrated success driving operational excellence, process improvement, stakeholder adoption, and organizational change. Ability to translate complex governance requirements into practical, sustainable business processes. Demonstrated growth mindset, intellectual curiosity, and willingness to learn, adapt, and continuously improve in a rapidly evolving environment. Understanding of AI governance principles, emerging AI risks, responsible AI practices, and the integration of AI requirements into enterprise governance and control frameworks. Exceptional attention to detail, with a commitment to accuracy, consistency, completeness, and high-quality deliverables. Self-directed, collaborative, and comfortable managing competing priorities in a highly matrixed environment. Preferred Experience Cybersecurity governance and controls operating models Policy, standard, configuration baseline, procedure, and guidance lifecycle management Cybersecurity Risk Acceptance Memorandum, policy exception, corrective-action, and retirement governance Service catalog, service ownership, intake, workflow, portfolio reporting, and operating health Control libraries, framework mapping, evidence expectations, requirement-centric governance, and policy-as-code readiness Third-party and vendor security governance, continuous monitoring, and incident-response integration Data protection, AI, identity, attack surface, resilience, and infrastructure governance GRC platforms, records of authority, workflow automation, dashboarding, and cross-system integration Regulatory and audit interpretation, executive communications, and leadership decision support Organizational change, stakeholder socialization, self-service enablement, and sustainable adoption Additional Requirements Fully Remote : This position has been designated as fully remote, meaning that the position is expected to contribute from a non-NBCUniversal worksite, most commonly an employee’s residence. This position is eligible for company sponsored benefits, including medical, dental and vision insurance, 401(k), paid leave, tuition reimbursement, and a variety of other discounts and perks. Learn more about the benefits offered by NBCUniversal by visiting the Benefits page of the Careers website. Salary range: $110,000 - $140,000 (bonus eligible) As part of our selection process, external candidates may be required to attend an in-person interview with an NBCUniversal employee at one of our locations prior to a hiring decision. NBCUniversal's policy is to provide equal employment opportunities to all applicants and employees without regard to race, color, religion, creed, gender, gender identity or expression, age, national origin or ancestry, citizenship, disability, sexual orientation, marital status, pregnancy, veteran status, membership in the uniformed services, genetic information, or any other basis protected by applicable law. If you are a qualified individual with a disability or a disabled veteran, you have the right to request a reasonable accommodation if you are unable or limited in your ability to use or access as a result of your disability. You can request reasonable accommodations by emailing . For LA County and City Residents Only: NBCUniversal will consider for employment qualified applicants with criminal histories, or arrest or conviction records, in a manner consistent with relevant legal requirements, including the City of Los Angeles' Fair Chance Initiative For Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act, where applicable. NBCUniversal is one of the world's leading media and entertainment companies. We create world-class content, which we distribute across our portfolio of film, television, and streaming, and bring to life through our global theme park destinations, consumer products, and experiences. We own and operate leading entertainment and news brands, including NBC, NBC News, NBC Sports, Telemundo, NBC Local Stations, Bravo, and Peacock, our premium ad-supported streaming service. We produce and distribute premier filmed entertainment and programming through our powerhouse film and television studios, including Universal Pictures, DreamWorks Animation, and Focus Features, and the four global television studios under the Universal Studio Group banner, and operate industry-leading theme parks and experiences around the world through Universal Destinations & Experiences, including Universal Orlando Resort, home to Universal Epic Universe, and Universal Studios Hollywood. NBCUniversal is a subsidiary of Comcast Corporation. Visit for more information. Our impact is rooted in improving the communities where our employees, customers, and audiences live and work. We have a rich tradition of giving back and ensuring our employees have the opportunity to serve their communities. We champion an inclusive culture and strive to attract and develop a talented workforce to create and deliver a wide range of content reflecting our world.