GRC Analyst
Salary
$107,716.98 Annually
Location
10 Park Plaza, Boston
Job Type
Full-Time
Job Number
26-20254
Department
MBTA - Information Technology Dept
Area
031-ITD
Opening Date
09/15/2026
Closing Date
9/29/2026 11:59 PM Eastern
Bargaining Unit
MBTA L453 Professional
Licenses / Certifications
Please see job description.
Safety Sensitive
No; this is not a Safety Sensitive position.
Essential Classification (Emergency Staff)
Yes; this position is classified as essential. Employees in this role are required to report to work for their assigned work hours or as directed by supervisory personnel during declared States of Emergency.
On-Call or 24/7
Yes; this position is classified as on-call or 24/7. Employees in this role must be available to respond to page/text/call and report to work as directed by supervisor personnel.
- Description
- Benefits
- Questions
At the MBTA, we envision a thriving region enabled by a best-in-class transit system. Our mission is to serve the public by providing safe, reliable, and accessible transportation. MBTA's core values are built around safety, service, equity, sustainability, culture, and accessibility, and each employee that works for the MBTA performs their roles based on our vision, mission, and values. This includes attendance, participation, and contribution in local safety committee meetings as needed.
Job Summary
The Governance, Risk, and Compliance (GRC) Analyst is responsible for identifying, assessing, monitoring, and mitigating organizational risks while ensuring compliance with applicable regulatory requirements, industry standards, and internal policies. This role works closely with business units, Information Technology (IT), cybersecurity, audit, and leadership to strengthen the organizations governance, risk management, and compliance framework.
Duties & Responsibilities
Enterprise & Information Security Risk Management
- Conduct comprehensive enterprise and information security risk assessments to identify threats and vulnerabilities across IT, Operational Technology (OT), and business processes.
- Maintain and continuously update the MBTAs risk register, ensuring timely tracking of remediation actions and residual risk. Evaluate business processes, technical controls, and governance workflows to ensure they effectively mitigate identified risks and align with MBTA's centralized compliance strategy.
- Support the maturation of risk methodologies, including development of risk scoring models, prioritization frameworks, and automated reporting feeds.
Governance, Compliance & Regulatory Alignment
- Support the development, implementation, and continuous improvement of governance, risk, and compliance programs and procedures.
- Monitor and report compliance against regulatory requirements, industry standards, and internal policies, including International Organization for Standardization (ISO) 27001, National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)/800-53, Service Organization Control (SOC) 2, Payment Card Industry Data Security Standard (PCI DSS), Transportation Security Administration (TSA) Surface Directives, United States Coast Guard (USCG) requirements, General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), Sarbanes-Oxley Act (SOX), and other MBTA-applicable mandates.
- Assist with maintaining authoritative policy and standards documentation; participate in policy review cycles and support enterprise-wide enforcement.
Third-Party & Supply-Chain Risk
- Perform detailed third-party/vendor security assessments covering onboarding, due-diligence, SOC 2/Federal Risk and Authorization Management Program (FedRAMP)/ISO attestation reviews, contractual security clauses, and ongoing monitoring.
- Track vendor remediation activities and partner with Procurement, Legal, and business owners to ensure sustained compliance.
Audit Support & Evidence Management
- Assist with internal and external audits by gathering documentation, coordinating evidence collection, validating controls, and supporting remediation plans.
- Serve as a liaison between business units, auditors, and Information Security to ensure timely and accurate audit responses.
Analytics, Reporting & Executive Dashboards
- Develop risk dashboards, status reports, metrics, and executive-level summaries for leadership, including trends, Key Performance Indicators (KPIs), Key Risk Indicators (KRIs), and compliance performance indicators.
- Maintain high-quality data integrity within GRC platforms (e.g., ServiceNow GRC, Archer) by ensuring accuracy of control catalogs, assessments, exceptions, and workflow automation.
Cross-Functional Collaboration & Advisory Support
- Partner with IT, Cybersecurity, Operations, Legal, Finance, and business teams to identify control gaps and recommend actionable mitigation strategies.
- Support enterprise roadmaps by providing risk insights that influence technology, process, and operational decisions.
- Assist team leaders and stakeholders in understanding risk exposure, obligations, and governance expectations.
Policy Governance & Awareness
- In collaboration with the GRC Policy Analyst, support policy development, review cycles, distribution, and enforcement efforts across the enterprise.
- Promote risk awareness, compliance practices, and security-first principles through communications, targeted training, and awareness campaigns.
Continuous Monitoring & Professional Development
- Stay informed of emerging cybersecurity threats, regulatory changes, industry frameworks, and best practices relevant to MBTA operations.
- Evaluate opportunities for process improvements, automation, and enhanced risk analysis techniques.
Additional Responsibilities
- Provide risk assessment and compliance support for OT environments and transit-related systems.
- Assist the teams Deputy Director or other leadership in executing enterprise-level initiatives related to centralized compliance, regulatory coordination, and risk governance. Stakeholder Engagement & Communication
- Prepare briefing materials for executive committees, regulatory inquiries, and cross-department collaborations.
- Perform all other duties and projects that may be assigned.
Additional responsibilities may include focus on one or more departments or locations. See applicable addendum for department or location specific functions.
Supervision
Minimum Requirements & Qualifications
- Bachelors degree in Information Technology, Cybersecurity, Information Systems, Business, Finance, Risk Management, or a related field.
- Two (2) years of experience in Governance, Risk, Compliance, Information Security, Internal Audit, or Enterprise Risk Management.
- Experience performing risk assessments and documenting findings.
- Knowledge of risk management methodologies and control frameworks.
- Familiarity with regulatory and compliance standards (e.g., NIST CSF/800-53, ISO 27001, SOC 2, PCI DSS, HIPAA GDPR, SOX).
- Strong analytical, organizational, and problem-solving skills.
- Excellent written and verbal communication skills.
- Ability to work cross-functionally with technical and non-technical stakeholders.
Substitutions
- A high school diploma or GED with an additional seven (7) years of directly related experience substitutes for the bachelor's degree requirement.
- An associate's degree from an accredited institution and an additional three (3) years of directly related experience substitutes for the bachelor's degree requirement.
- A master's degree in a related subject substitutes for two (2) years of general experience.
- A nationally recognized certification, or statewide/professional certification in a related field substitutes for one (1) year of experience.
Preferred Experience & Skills
- Certified Information Systems Auditor (CISA).
- Certified in Risk and Information Systems Control (CRISC).
- Certified Information Systems Security Professional (CISSP).
- Certified Information Security Manager (CISM).
- Project Management Professional (PMP).
Job Conditions:
- Ability to effectively read, comprehend, communicate, and respond to instructions, orders, signs, notices, inquiries, etc. in English.
- Be at least eighteen (18) years of age, except if participating in an approved high school internship / co-op program.
- Ability to commute to assigned work locations in the Boston, MA metro area, as required by the role.
- Ability to provide internal and external customers with courteous and professional experiences.
- Ability to work effectively, independently, and as part of a diverse workforce team (or supervise, if required).
- Ability to uphold the rights and interests of the MBTA while building and maintaining effective relationships with employees and co-workers.
- Ability to adhere to rules, regulations, collective bargaining agreements (if applicable), and policies of the MBTA, including the EEO, anti-discrimination, anti-harassment, and anti-retaliation policies.
- Have a satisfactory work record for the two (2) years immediately prior to the closing date of this posting (unless if current student or recent graduate), including overall employment, job performance, discipline, and safety records (infractions and/or offenses occurring after the closing of the posting and before the filling of a vacancy may preclude a candidate from consideration for selection).
- Ability to pass a Criminal Offender Record Information (CORI) check, comprehensive background screening, and / or medical Clinic screening, potentially including physical examination and drug and alcohol screenings.
- Ability to work all shifts and / or locations assigned, directed, or necessary for this position, including (for some transit / operations roles) up to twenty-four (24) hours per day, seven (7) days per week as necessary to accommodate severe weather conditions, emergencies, or any other circumstances that may potentially impact service or the safety of service.
- Intern / co-op staff must be enrolled full or part-time in an accredited educational program and maintain a cumulative GPA of at least 2.5 for the entire duration of the internship / co-op. Additionally, interns / co-ops must have valid work authorization and U.S. Social Security Number prior to starting pre-employment screenings / pre-boarding, working in their positions, and throughout the duration of their program.
Disclaimers and Definitions:
- General Disclaimer: The statements contained in this job description are intended to describe a summary, general nature, and complexity of typical job functions and do not represent an exhaustive list of all duties, tasks, and responsibilities required of staff assigned to this position.
- Application Completion: It is each applicant's responsibility to ensure application details are entered completely and correctly, including updated work and education histories (past and current). Incomplete applications may not be considered. Attachments do not substitute for application fields. The recruitment team does not have access to existing employee data / history.
- Application Deadlines: Applicants should apply as soon as possible, as the MBTA may stop considering applicants after a sufficiently large applicant pool is established.
- Work Environment: The physical demands and work environment characteristics described here-in are representative of those an employee may encounter while performing the essential functions of this job. Reasonable accommodations can be made to enable individuals with disabilities to perform essential functions. See job description for role-specific requirements.
- Work Eligibility: All employees must be legally authorized to work in the United States and on an unrestricted basis. The MBTA does not have an employer work sponsorship program. However, if you have unrestricted work authorization, or are sponsored by a separate entity, you are welcome to apply. Further, all persons hired will require a U.S. Social Security Number prior to starting the position and employees will be required to complete a Form I-9 to verify their identity and eligibility to work in the U.S.
- Interviews: Candidates should ensure they arrive on time, are prepared, can remain for the duration, and if remote, are in a quiet place without distraction, for the interview. Candidates who do not attend their interview without advance authorization, including an email confirmation of a rescheduled time/date from Human Resources, will be considered a no-show and disqualified from consideration for the position. Related to rescheduling, on a one-time basis, and due to something emergent, you may be allowed to reschedule the interview. In addition, Human Resources may require documentation supporting the request. However, should you need to reschedule, you will need to contact your Recruiter directly by email.
- Safety Sensitive Positions: Employees working in this classification will be subject to periodic physical examinations plus random drug and alcohol testing.
- On-call or 24/7 Positions: Employees working in this classification must be available to respond to page / text / call and report to work as determined by assigned department or the Authority.
- Essential / Emergency Staff: During declared "states of emergency," employees working in this classification are required to report to work for their assigned work hours or as directed by management.
- ADA Accommodations: The MBTA makes reasonable accommodations for applicants with disabilities. If you require an accommodation during this process, please contact the MBTAs ADA Unit at 617-222-5751 or hradaaa@mbta.com.
- Diversity, Equity, and Inclusion: The MBTA is an Equal Employment Opportunity Employer. For terms, descriptions, and definitions related to diversity, equity, inclusion, veteran status, and immediate family members that you may find on the application form, please visit mbta.com/careers-app-definitions.
- Intern / Co-Op Benefits: Employees taking part in an internship or co-op at the MBTA are eligible to receive accrued paid sick leave as well as a monthly transportation pass, based on the city from which the intern / co-op commutes to work, at no cost. However, no additional benefits are currently offered for interns or co-ops.
Employment Benefits at the MBTA
Full-Time Employees:
The MBTA offers comprehensive benefits packages. Types of benefits offered at the MBTA are subject to the union affiliation / Collective Bargaining Agreement (CBA) of the position to which you apply. Benefits that may apply to your position include the following:
- Insurance: Health, Dental, Vision, Life (basic and supplemental), and Long-Term Disability
- Paid Time Off (PTO): Vacation, Personal Days, Sick Leave, and Holidays
- Retirement: Pension or deferred compensation 401(a), plus MBTA contributions
- Complimentary pass for travel on the MBTA transit system (bus, train, ferry, and Commuter Rail)
- Tuition Reimbursement (up to $10,000 per year)
- Public Service Loan Forgiveness (PSLF) for student loans
- Commuter Choice Parking Program: Pre-tax benefits for parking
- Flexible Spending Account (FSA): Pre-tax benefits for healthcare-related expenses
- Discounted tickets for concerts, movies, travel / vacation, etc. via TicketsAtWork.com
- Shopping discounts via GovX.com
- Verizon and AT&T service discounts
- And more...
Disclaimer:
The above information is meant to be a general overview of the benefit programs offered by the MBTA, which may or may not apply to a specific position. This summary is not a contract and is not meant to change the provisions of union contracts or Authority policies and does not establish a binding practice. Please contact the assigned Recruiter directly or email hrstaffing@mbta.com for more information.
The MBTA is an Affirmative Action/Equal Opportunity Employer
01
Which of the following best describes your education and experience?
- I do not have a High School Diploma or GED Equivalent.
- A High School Diploma or GED and nine (9) years of experience in Governance, Risk, Compliance, Information Security, Internal Audit, or Enterprise Risk Management.
- An associate degree from an accredited institution and five (5) years of experience in Governance, Risk, Compliance, Information Security, Internal Audit, or Enterprise Risk Management.
- A Bachelors Degree in Information Technology, Cybersecurity, Information Systems, Business, Finance, Risk Management, or a related field and two (2) years of experience in Governance, Risk, Compliance, Information Security, Internal Audit, or Enterprise Risk Management.
- A master's degree in a related subject and general experience in Governance, Risk, Compliance, Information Security, Internal Audit, or Enterprise Risk Management.
- A nationally recognized certification, or statewide/professional certification and one (1) year of experience in Governance, Risk, Compliance, Information Security, Internal Audit, or Enterprise Risk Management.
02
Do you have experience performing risk assessments and documenting findings?
03
Do you have knowledge of risk management methodologies and control frameworks?
04
Do you have knowledge of regulatory and compliance standards (e.g., NIST CSF/800-53, ISO 27001, SOC 2, PCI DSS, HIPAA GDPR, SOX)?
05
Are you legally authorized to work in the United States?
06
Will you now or in the future require visa sponsorship to continue working in the United States (e.g. H-1B visa status)?
Required Question
Employer Massachusetts Bay Transportation Authority
Address 10 Park Plaza
Boston, Massachusetts, 02116
Phone (617) 222-3200
Website https://www.mbta.com