Governance Risk and Compliance Analyst Jobs in Tucson, AZ
Governance, risk and compliance analysts in Tucson keep the controls and paperwork behind secure systems in order, from defense authorization packages to hospital and credit union audits. Posted pay here runs from about $66,000 to $126,000 a year. Current openings are below, followed by who is hiring and how to break in.
Current Governance Risk and Compliance Analyst Openings in Tucson, AZ
Listings marked External are sponsored openings provided by the Jobs2Careers network.
Governance Risk and Compliance Analyst Work in Tucson
Tucson's GRC work splits three ways. The first is defense: contractors supporting Davis-Monthan Air Force Base and other defense programs hire information systems security officers and managers to run Risk Management Framework assessments, keep authorization packages current and answer to government program managers. Those jobs are onsite and usually require a clearance.
The second is regulated business. Tucson Medical Center on Grant Road needs analysts who write security policy and track internal controls, Hughes Federal Credit Union on West Wetmore Road preps for federal exams, and Hexagon's office on East Congress Street downtown hires for IT governance across its division. The third is public, led by the University of Arizona's Information Security Office, which runs the campus security operations center.
Top Tucson Employers Hiring Governance Risk and Compliance Analysts
These Tucson employers have posted GRC and security compliance roles on their own careers sites:
- Hexagon - an IT GRC Specialist role, permanent and full time, out of its downtown Tucson office, checking that IT systems and controls meet regulations and internal policy.
- General Dynamics Information Technology (GDIT) - an onsite Information Systems Security Manager in Tucson who advises defense customers on RMF assessment and authorization and runs risk assessments.
- Tucson Medical Center - IS Security Analyst roles covering security policy, risk mitigation, internal controls and compliance tracking for the TMC Health system.
- Hughes Federal Credit Union - a cybersecurity analyst at its Wetmore branch whose duties included IT governance, risk and compliance and support for audits and federal exams.
Governance Risk and Compliance Analyst Salaries in Tucson
- Entry level (0-2 years): roughly $62,000 to $78,000 per year.
- Experienced (3-6 years): roughly $78,000 to $105,000 per year.
- Senior, ISSM or GRC lead (6+ years): roughly $105,000 to $135,000 per year.
These are estimates that vary by employer and experience. Hughes Federal Credit Union posted $66,000 to $83,000 for its analyst, and GDIT lists $93,500 to $126,500 for its Tucson ISSM. A security clearance is the biggest lever in this market, followed by a senior certification such as CISSP or CISA.
How to Become a Governance Risk and Compliance Analyst in Tucson
Most employers want a bachelor's degree or equivalent experience plus a few years in IT or security. Pima Community College's Cybersecurity AAS at East Campus on Irvington Road is an NSA Center of Academic Excellence program that names risk and compliance analyst among its target jobs. The University of Arizona's College of Information Science offers a BAS in Cyber Defense, and its James E. Rogers College of Law offers a Master of Legal Studies with a Compliance and Legal Risk Management emphasis. Arizona has no state license for GRC analysts. Defense roles instead require DoD 8140 qualification, such as CompTIA Security+ for IAT Level II, plus a clearance and U.S. citizenship.
What the Job Involves
A GRC analyst maps systems to a control framework such as NIST 800-53, collects evidence that each control works, and writes up the gaps. The week includes updating policies and procedures, tracking remediation tickets, preparing for audits and regulator exams, reviewing vendor risk, and in defense work assembling the security authorization package a government official signs before a system can operate.
Skills Employers Look For
- Working knowledge of NIST 800-53 and the Risk Management Framework
- Policy, standards and procedure writing
- Audit preparation and evidence collection
- Risk assessment and remediation tracking
- HIPAA or financial exam experience for health care and credit union roles
- Security+ early, then CISSP, CISA or CRISC
- An active or obtainable clearance for defense work
Career Path and Advancement
In Tucson the path often starts in help desk, systems administration or a junior security analyst seat, then moves to GRC or ISSO work after a year or two. From there it runs to senior analyst, ISSM and security program manager on the defense side, or to information security manager and compliance officer at a hospital or credit union. Analysts who hold a clearance and a senior certification have the most options here.
Related Careers in Tucson
These Tucson guides cover the closest alternatives for GRC analysts:
Frequently Asked Questions
Do you need a license to work as a GRC analyst in Arizona?
No. Arizona does not license governance, risk and compliance analysts. Employers use certifications instead, and defense contractors in Tucson require DoD 8140 qualification such as Security+ along with a clearance.
How much do GRC analysts make in Tucson?
Expect roughly $62,000 to $78,000 a year at entry level and $105,000 or more at the senior and ISSM level. Hughes Federal Credit Union posted $66,000 to $83,000 for its analyst, and GDIT lists $93,500 to $126,500 for its Tucson ISSM.
Which Tucson employers hire GRC analysts?
Recent own-site postings came from Hexagon downtown, GDIT, Tucson Medical Center and Hughes Federal Credit Union. Defense contractors also post ISSO and ISSM roles in Tucson, and those usually require a clearance.
Do you need a security clearance for GRC work in Tucson?
For defense roles, yes. GDIT's Tucson ISSM requires an active Top Secret/SCI clearance and U.S. citizenship. The Tucson hospital, credit union and Hexagon postings did not ask for one.
Can you train for GRC work locally?
Yes. Pima Community College's Cybersecurity AAS at East Campus takes about two years full time and lists risk and compliance analyst among its target jobs. The University of Arizona offers a BAS in Cyber Defense and a compliance-focused Master of Legal Studies.
Ready to apply? Browse all governance risk and compliance analyst jobs in Tucson, AZ on TucsonHIRED and apply today.