GRC Analyst

Hayward Holdings Inc. (NYSE "HAYW") is one of the leading manufacturers of residential swimming pool equipment in the world, with a significant presence in the commercial pool market that is continuously growing. Hayward designs, manufactures, and markets a full line of residential and commercial pool and spa equipment including pumps, filters, heating, cleaners, salt chlorinators, automation, lighting, safety, flow control and energy solutions at our company owned facilities. Headquartered in Charlotte, North Carolina, Hayward also has facilities in Tennessee, Arizona, and Rhode Island, Georgia, as well as Canada, Spain, France, Australia, and China.

Senior Cybersecurity Risk & Governance Analyst

Data Loss Prevention/Governance, Risk Management, & Data Security

Location: Clemmons, NC

Reports To: Director, Global Information Security

Job Summary

The Senior Cybersecurity Risk & Governance Analyst supports the organization's cybersecurity governance, risk, compliance, identity governance, and data protection programs. This role serves as a subject matter expert for IT controls supporting SOX and Internal Controls over Financial Reporting (ICFR), including control assessment, audit support, risk identification, and remediation.

The Senior Analyst also supports cybersecurity risk assessments, policy and standards development, access governance, third-party risk, and alignment with frameworks including NIST CSF, NIST SP 800-53, ISO 27001, and CIS Controls.

The role provides governance and operational support for Varonis and SailPoint, partnering with Information Security, IT, Finance, Internal Audit, external auditors, application owners, and business stakeholders to identify and mitigate cybersecurity and compliance risks.

Key Responsibilities

Cybersecurity Governance & Risk Management

• Perform cybersecurity risk assessments across applications, infrastructure, cloud services, and technology initiatives.
• Maintain cybersecurity risk registers, remediation plans, control exceptions, and risk treatment activities.
• Map security controls to NIST, ISO 27001, CIS, SOX, and applicable regulatory requirements.
• Develop GRC metrics, KRIs, KPIs, and management reporting to communicate cybersecurity risk and compliance posture.
• Identify opportunities to automate and mature GRC processes.

SOX Compliance & Internal Controls

• Support the design, documentation, testing, and operation of IT General Controls (ITGCs) supporting SOX and ICFR.
• Execute and assess controls covering logical access, privileged access, change management, system operations, and data integrity.
• Assess control effectiveness, identify deficiencies, perform root-cause analysis, and coordinate remediation.
• Produce complete, defensible audit evidence and maintain control narratives, Risk and Control Matrices (RCMs), and testing documentation.
• Serve as a key liaison with Internal Audit, external auditors, control owners, and IT leadership.
• Identify opportunities for control automation and improved audit efficiency.

Data Security & Varonis Administration

• Administer Varonis capabilities supporting sensitive-data discovery, classification, monitoring, and access governance.
• Identify excessive or inappropriate access to sensitive, financial, confidential, and regulated information.
• Partner with data owners to remediate inappropriate permissions and strengthen least-privilege access.
• Develop reports, dashboards, alerts, and audit evidence related to data security and access.
• Support investigations involving sensitive-data exposure and inappropriate access.

Identity & Access Governance

• Perform and oversee SOX-related User Access Reviews (UARs) and periodic access certifications.
• Validate provisioning, modification, termination, privileged access, and segregation-of-duties controls.
• Support enhancement of the SailPoint environment, including application onboarding, entitlement aggregation, role modeling, access certifications, and lifecycle processes.
• Assist with development of Role-Based Access Control (RBAC) models, access profiles, and entitlement structures.
• Identify opportunities to automate access governance and improve oversight of privileged and high-risk accounts.

Audit, Compliance & Third-Party Risk

• Coordinate IT and cybersecurity activities supporting internal and external audits.
• Manage cybersecurity and control findings through remediation and closure.
• Support security assessments of vendors, technology providers, and cloud services.
• Review SOC 1/SOC 2 reports, ISO 27001 certifications, security assessments, and other third-party assurance documentation.
• Partner with Audit, Legal, Privacy, IT, and business owners to address identified third-party risks.

Leadership & Stakeholder Engagement

• Independently evaluate cybersecurity and compliance risks and recommend appropriate solutions.
• Serve as a trusted advisor to technical and business stakeholders on security controls, SOX, Privacy, and data protection.
• Translate technical and control issues into clear business risks and recommendations.
• Lead cross-functional discussions regarding control deficiencies, risk acceptance, and remediation.

Qualifications & Requirements

Required

• Bachelor's degree in Cybersecurity, Information Systems, IT, Accounting, Risk Management, or related field, or equivalent experience.
• 5+ years of experience in cybersecurity GRC, IT risk, IT audit, SOX compliance, or information security.
• Strong knowledge of ITGCs, ICFR, logical access, privileged access, change management, and audit evidence requirements.
• Hands-on experience with Varonis or comparable data loss prevention technology.
• Experience with SailPoint or comparable identity governance platforms.
• Working knowledge of NIST CSF, NIST SP 800-53, and ISO 27001 Controls.
• Strong analytical, documentation, communication, and stakeholder-management skills.
• Demonstrated ability to work independently and manage multiple initiatives and deadlines.

Preferred

• CISA, CRISC, CISSP, CISM, CGEIT, or CIA certification.
• 8-10 years of experience within a global, publicly traded, manufacturing, or similarly complex enterprise.
• Experience with Varonis, SailPoint, SharePoint, and Microsoft 365.
• Experience with GRC and cybersecurity risk reporting.
• Knowledge of cloud security, third-party risk, data privacy, and data governance.
• Experience automating controls, continuous monitoring, or audit-evidence collection.

Core Competencies

• Cybersecurity Risk & Governance
• SOX / ITGC Compliance
• IT Audit & Control Testing
• Identity & Access Governance
• Varonis & Data Security
• SailPoint / Identity Governance
• NIST / ISO / CIS Frameworks
• Third-Party Risk Management
• Policy & Standards Development
• Audit & Remediation Management
• Executive Risk Reporting
• Cross-Functional Leadership

#LI-LS1