GRC Analyst - Hybrid AZ
Join BWH Hotels – Where Passion Meets Purpose At BWH® Hotels, we don't just offer employment opportunities, we create opportunities to be part of something extraordinary. As a global leader in hospitality for nearly 80 years, our vision is to inspire travel through unique experiences. Joining our corporate team means becoming part of a dynamic and inclusive community that values innovation, collaboration, and making a meaningful impact in the travel industry.Headquartered in Phoenix, Arizona, BWH Hotels boasts a powerful portfolio of 18 brands, including WorldHotels™, Best Western® Hotels & Resorts, and SureStay Hotels®, with approximately 4,300 hotels in over 100 countries. We take pride in our top-ranking employee engagement scores and foster a workplace culture where your contributions truly matter. Join us and be part of a team that's shaping the future of hospitality!Job Purpose:Ensures the confidentiality, integrity, and availability of Company data and information technology assets by supporting governance, risk, and compliance activities, including security policy and standards management, risk management, disaster recovery coordination, audit readiness, and regulatory compliance. This role supports PCI DSS, SOX, privacy, and broader cybersecurity compliance activities across the organization.Key Responsibilities:The ideal candidate will be able to build rapport and credibility with internal stakeholders, business partners, member hotel representatives, and technology teams to support effective governance, risk, and compliance outcomes. Excellent communication and interpersonal skills are required to coordinate evidence requests, explain control expectations, and drive timely follow-through.Demonstrated experience supporting compliance frameworks and control environments such as PCI DSS v4.0.1, NIST, COBIT, ISO 27001, SOX, privacy regulations, and related cybersecurity standards.Coordinate with internal stakeholders and external auditors to maintain current documentation for control scoping, evidence collection, testing support, remediation tracking, and validation of IT and cybersecurity controls.Work with stakeholders to fulfill evidence requests within committed timelines and ensure evidence is complete, accurate, and mapped to applicable control requirements.Conduct recurring control reviews with stakeholders to identify gaps, track remediation progress, and provide actionable advisement to management.Review audit findings, control gaps, and compliance risks; partner with control owners to document remediation plans, track progress, and escalate delays or blockers as appropriate.General understanding of Sarbanes-Oxley (SOX) compliance requirements, IT General Controls, and audit evidence expectations.Thorough knowledge of PCI-related standards and guidance, including PCI DSS v4.0.1, ASV requirements, payment security documentation, and software security requirements where applicable.Thorough understanding of applicable privacy ...