Job Description

What’s Under the Hood

DriveTime Family of Brands is the largest privately owned used car sales finance & servicing company in the nation. Headquartered in Tempe, Arizona and Dallas, Texas, we create opportunities and improve the lives of our customers and our employees by placing a focus on putting the right customer, in the right vehicle, on the right terms and on their path to ownership.

The DriveTime Family of Brands spans across DriveTime, Bridgecrest and SilverRock. You can find us at the intersection of technology and innovation as we use our proprietary tools and over two decades of industry knowledge to redefine the process of purchasing, financing, and protecting your vehicle.

That’s Nice, But What’s the Job?

In short, you’ll serve as a senior-level technical risk leader within the Information Security Governance, Risk & Compliance (GRC) function. In this role, you'll independently lead complex cybersecurity risk assessments across applications, infrastructure, cloud environments, identity platforms, data protection controls, and business processes. You'll help strengthen and mature the organization's risk management program by developing standardized assessment methodologies, guiding risk treatment decisions, supporting compliance and audit initiatives, leading third-party assessments, and mentoring other GRC professionals. This position requires a strong blend of technical cybersecurity knowledge, business risk acumen, and the ability to influence stakeholders across the organization.

In Long, as the Lead GRC Analyst, you will be responsible for

• Leading complex Information Security risk assessments across applications, infrastructure, cloud, identity, data, and business processes, including threat identification, control evaluation, likelihood and impact analysis, risk scoring, treatment planning, documentation, tracking, and reporting.
• Developing, standardizing, and enhancing cybersecurity risk assessment methodologies, control evaluation frameworks, documentation standards, risk scoring models, and management reporting processes.
• Leading assigned GRC services and initiatives including compliance monitoring, policy governance, audit support, third-party security assessments, due diligence activities, and related risk management processes.
• Providing technical risk management leadership, subject matter expertise, quality reviews, process improvement recommendations, and mentorship to other analysts.
• Independently assessing technical security findings, vulnerabilities, and compensating controls to develop clear risk statements and actionable treatment recommendations.
• Evaluating business impacts, identifying material cybersecurity risks, and preparing risk acceptance or remediation recommendations for management decision-making.
• Conducting control assessments against applicable policies, standards, regulatory obligations, contractual requirements, and industry frameworks while tracking remediation and recurring issues.
• Leading third-party cybersecurity assessments and partnering with Vendor Management, Legal, Compliance, Technology, and business stakeholders to identify and address security risks.
• Coordinating and developing responses to cybersecurity due diligence questionnaires, customer security reviews, external assessments, insurance inquiries, and related requests.
• Supporting and improving Information Security policy governance through drafting, reviewing, updating, and maintaining policies, standards, and related documentation.
• Owning or supporting Information Security awareness and education initiatives, including communications, training content, campaign development, program metrics, and continuous improvement efforts.
• Serving as the primary owner for assigned GRC services and risk management processes by establishing procedures, metrics, governance routines, and accountability frameworks.
• Mentoring GRC Analysts and promoting consistent, high-quality risk assessment and reporting practices throughout the organization.
• Performing other duties as assigned.

So What Kind of Folks Are We Looking For?

• Strong technical understanding of cybersecurity threats, vulnerabilities, attack vectors, and security controls across identity, network, endpoint, application, cloud, and data security domains.
• Ability to independently assess technical risks, identify control gaps, evaluate compensating controls, and determine practical risk treatment strategies.
• Strong analytical and critical thinking skills with the ability to challenge assumptions, prioritize risks, and make sound risk-based recommendations.
• Exceptional written and verbal communication skills with the ability to translate complex technical risks into business-focused recommendations.
• Strong organizational and project management skills with the ability to manage multiple concurrent initiatives and assessments.
• Ability to influence and collaborate effectively with technical and non-technical stakeholders without direct authority.
• Demonstrated ability to improve processes, methodologies, reporting capabilities, and governance practices.
• Strong attention to detail and commitment to producing high-quality risk assessments, documentation, and reporting.
• Ability to mentor and develop less experienced team members while fostering collaboration and continuous improvement.
• Comfortable navigating ambiguity and driving results in a dynamic, evolving cybersecurity environment.

The Specifics.

• 7+ years of relevant experience in Information Security, cybersecurity risk management, security engineering, security architecture, IT risk, IT audit, or a related discipline.
• 3+ years of experience independently leading technical cybersecurity risk assessments.
• Demonstrated experience assessing applications, infrastructure, cloud environments, identity solutions, or other technical systems and evaluating associated security controls and threat scenarios.
• Experience developing risk statements, conducting control assessments, and delivering actionable risk treatment recommendations.
• Experience establishing, enhancing, or maturing cybersecurity risk assessment methodologies, documentation practices, scoring models, governance routines, or reporting frameworks.
• Strong knowledge of the NIST Cybersecurity Framework (CSF).
• Familiarity with NIST SP 800-30, NIST SP 800-53, or similar cybersecurity risk assessment and control frameworks.
• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Computer Science, Risk Management, or a related field.

Nice to Have

• CISSP, CRISC, CISA, or comparable cybersecurity, risk, or audit certifications.
• Experience within regulated industries, particularly financial services.
• Knowledge of GLBA, FTC Safeguards Rule, PCI DSS, privacy regulations, or related compliance requirements.
• Experience supporting third-party risk management programs.
• Experience with security awareness and training initiatives.
• Experience supporting internal or external audits.
• Familiarity with GRC platforms and risk management technologies.
• Experience leading cross-functional projects and influencing stakeholders at multiple organizational levels.

So What About the Perks? Perks matter

• Work From Home. Feel free to rock the casual wear while still being camera ready. You will be working from your home office (in an approved city & state) and make sure you have a conducive and quiet workspace with no distractions and reliable and secure internet.
• Medical, dental, and vision, oh my! DriveTime Family of Brands covers a sizable amount of insurance premiums to ensure our employees receive top-tier healthcare coverage.
• But Wait, There’s More. 401(K), Company paid life insurance policy, short and long-term disability coverage to name a few.
• Growth Opportunities. You grow, I grow, we all grow! But seriously, DriveTime Family of Brands is committed to providing its employees with every opportunity to grow professionally with roughly over 1,000 employees promoted year over year.
• Tuition Reimbursement. We’re as passionate about your professional development as you are. With that, we’ll put our money where our mouth is.
• Wellness Program. Health is wealth! This program includes self-guided coaching and journeys, cash incentives and discounts on your medical premiums through engaging in fun activities!
• Gratitude is Green. We offer competitive pay across the organization, because, well… money matters!
• Paid Time Off. Not just lip service: we work hard, to play hard! Paid time off includes (for all full-time roles) wellness days, holidays, and good ole' fashioned YOU time! For our Part-timers, don't fear you get some time too...vacation time is available - the more you work, the more you earn!

Anything Else? Absolutely.

DriveTime Family of Brands is Great Place to Work Certified! And get this: 90% of our rockstar employees say they feel right at home here. We could spend a lot of time having you read about ALL our awards, but we’ll save time (and practice some humility) just naming a few others; Comparably Awards: Best Company for Diversity, Best Company Culture and Best Company Leadership, oh and don’t forget Phoenix Business Journal Healthiest Employers (okay, we’ll stop there)!

Hiring is contingent upon successful completion of our background and drug screening process. DriveTime is a drug-free, tobacco-free workplace and an Equal Opportunity Employer.

And when it comes to hiring, we don't just look for the right person for the job, we seek out the right person for DriveTime. Buckle up for plenty of opportunities to grow in a professional, fun, and high-energy environment!