Governance, Risk, and Compliance (GRC) Data Analyst | Technology Services

With competitive pay, great benefits, and endless opportunities, working for the City and County of Denver means seeing yourself working with purpose — for you, and those who benefit from your passion, skills and expertise. Join our diverse, inclusive and talented workforce of more than 11,000 team members who are at the heart of what makes Denver, Denver.

This job posting will accept applications until 11:59PM on Sunday, October 11.

We kindly request that you submit a resume with your application materials.

The City and County of Denver offers a competitive salary commensurate with education and experience. The hiring salary range for this position is $74,276/year - $98,500/year, based on experience. We also offer generous benefits for full-time employees which include, but are not limited to:

• A guaranteed life-long monthly pension, once vested after 5 years of service
• 457B Retirement Plan
• 140 hours of PTO earned within first year + 11 paid holidays, 1 personal holiday and 1 volunteer day per year
• Competitive medical, dental and vision plans effective within 1 month of start date

More information about the perks and benefits we provide to full-time employees to allow them to find balance, thrive, and build a mile high career can be found on our website.

The City and County of Denver supports a hybrid workplace model. In this position, you can expect to work on-site at the Webb Municipal Building (201 W. Colfax Ave.) two (2) days per week. Employees must work within the state of Colorado on their off-site days.

The Technology Services Department (TS) of the City and County of Denver use state-of-the-art technologies and methodologies to deliver and improve the systems, applications, and operations to our customers. Technology Services supports the people, agencies, and ideas that make the City and County of Denver a world-class city. The city offers a unique opportunity to work with a diverse business and technology environment on a large scale as we employ more than 13,000 people, of which 9,000+ are daily technology consumers in support of a diverse population over 700,000 Denverites.

The City and County of Denver (CCD) approaches Governance, Risk, and Compliance (GRC) holistically ensuring that risks and vulnerabilities are evaluated not only from a system-security standpoint, but also through the lens of the end user and the application. The Governance, Risk, and Compliance Analyst position is a key stakeholder on the CCD GRC, Data Protection Team, contributing to a comprehensive program that spans vendor risk, policy governance, audit coordination, and access controls.

This role is responsible for advancing CCD Technology Services' (TS) governance, risk, and compliance objectives across several interconnected areas:

• Vendor Risk Management — Manage the TS Vendor Risk Assessment Program, ensuring all new and existing Citywide technology vendors are evaluated through initial and annual risk assessments. Determine the scope of required reviews, coordinate with vendors and internal stakeholders, and communicate assessment conclusions, including compliance and contract-language needs, approvals, and denials.

• Policy & Standards Governance — Manage TS policies and standards, ensuring all Citywide technology policies are reviewed and updated annually. Advise policy stakeholders on language and, when needed, take the lead on creating new policies and standards.

• Audit Coordination — Serve as the primary liaison between the CCD Auditor's Office and Technology Services. Manage and coordinate external audits, assist in gathering and creating deliverables, brief TS leadership on audit status and potential findings, and advise on and at times draft responses to audit finding recommendations.

• Access & Controls — Periodically audit system user permissions, recommend appropriate access levels, and ensure administrative privileges are restricted to those with a documented business need.

• Security Awareness & Training — Determine employee training needs based on identified user behavior and risk, partner with HR/Workday Learning to provision training to applicable employees, and monitor completion with timely follow-up.

• Broader GRC Support — Support additional GRC activities such as approving or denying third-party file-share requests, conducting risk assessments, ensuring regulatory compliance, and contributing to initiatives such as the role-based access control project. Act as an ongoing GRC subject-matter expert and liaison for other CCD agencies, advising on best practices to reduce risk and promote regulatory compliance

Key duties, tasks, and responsibilities of this position include:

• Utilizing ServiceNow to manage vendor risk assessments, TS audits, policies, and third-party file-share permission requests
• Responding to and organizing responses to third-party risk assessment requests from across CCD
• Collaborating with the CCD Auditor's Office throughout audit engagements and managing external audits end to end
• Assisting in the collection and creation of audit deliverables and providing leadership briefings on audit status and potential findings
• Advising TS stakeholders on the implementation of internal controls and safeguards in response to audit findings, and provide written responses to audit recommendations
• Identifying and conducting risk assessments across vendors, systems, and processes
• Reviewing access roles and permissions, ensuring proper safeguards and validated business needs
• Reviewing, selecting, and managing security-awareness training material and monitoring completion
• Collaborating with TS teams and CCD agencies to mitigate identified risk and promote regulatory compliance

The ideal candidate will have a strong foundation in governance, risk, and compliance, along with experience in policy creation, audits, and technical writing. We are also looking for someone who is comfortable working independently, takes initiative, and proactively identifies opportunities to streamline and improve processes.

• 2–3 years of experience in data protection and/or governance, risk, and compliance (relevant experience may supplement education requirements)
• Knowledge of, and experience applying, the following regulatory frameworks:
  • U.S. Department of Commerce, National Institute of Standards and Technology (NIST) Cybersecurity and Privacy Frameworks
  • Payment Card Industry Data Security Standard (PCI-DSS)
  • U.S. Department of Health and Human Services, Health Insurance Portability and Accountability Act (HIPAA)
• Experience using Workday, OneTrust, ServiceNow, and Box platforms
• A continuous‑improvement mindset, with the ability to evaluate processes, identify gaps, and implement effective, scalable solutions
• Demonstrated ability to work independently, manage priorities, and drive tasks to completion with minimal supervision

• A collaborative, relationship‑building approach, and a desire to support a culture of equity, inclusion, and continuous improvement

• Education requirement: Bachelor's Degree in Information Technology or a related field based on a specific position(s).
• Experience Requirement: Two years of experience with data protection, governance, risk assessment, and compliance with information technology systems.
• Education/Experience Equivalency: One (1) year of the appropriate type and level of experience may be substituted for each required year of post-high school education. Additional appropriate education may be substituted for the minimum experience requirements.
• Licensure/Certifications: None

Job Profile

To view the full job profile including position specifications, physical demands, and probationary period, click here.

Position Type

Position Salary Range

Target Pay

Agency

The City and County of Denver provides equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, national origin, sex, sexual orientation, gender identity, national origin, disability, genetic information, age, or any other status protected under federal, state, and/or local law. 

It is your right to access oral or written language assistance, sign language interpretation, real-time captioning via CART, or disability-related accommodations. To request any of these services at no cost to you, please contact [email protected] with three business days’ notice.

For information about right to work, click here for English or here for Spanish.