OverviewThe Senior IT GRC Analyst helps advance the organization's approach to technology and data risk by connecting governance, compliance, and security practices with business objectives. The role leads key aspects of IT SOX and third-party risk management, advises stakeholders on effective control design, and supports security leadership in building scalable, risk-based GRC and data security programs focused on reducing key areas of data exposure and protecting sensitive information.
Responsibilities • What You'll Do Essential Functions/Primary Responsibilities: - IT Risk Management Program:
- Assist the security leader in developing risk assessment and reporting tools that help prioritize resources and initiatives based on business impact, threat exposure, regulatory requirements, and organizational risk appetite.
- Assist in development and generation of meaningful risk and compliance metrics, and reporting that provides leadership with visibility into control effectiveness, risk exposure, remediation progress, third-party risk, and emerging trends.
- Assist in the performance of maturity assessments against accepted frameworks such as NIST CSF.
- SOX and Other Compliance Programs:
- Partner with IT control owners, Internal Audit, External Audit, Finance, and business stakeholders to coordinate the annual IT SOX lifecycle. This includes risk assessments, control scoping, testing readiness, evidence coordination, deficiency evaluation, remediation tracking, and management reporting.
- Support the design, documentation, monitoring, and continuous improvement of IT General Controls (ITGCs) and other technology controls supporting financial reporting.
- Support internal and external audits, regulatory inquiries, and customer or third-party assurance activities by coordinating responses, validating evidence, and ensuring identified issues are appropriately addressed.
- IT Governance and Controls:
- Support the development, maintenance, and lifecycle management of IT and information security policies and standards, partnering with stakeholders to ensure requirements are clear, risk-aligned, appropriately governed, and periodically reviewed.
- Provide control advisory support to technology teams, helping translate regulatory, audit, security, and risk requirements into practical, appropriately designed controls. This includes advising on control design for new systems, significant system changes, implementations, integrations, and evolving business processes, promoting a controls-by-design approach.
- Identify opportunities to simplify, standardize, automate, and strengthen controls while balancing compliance requirements with operational efficiency and business objectives.
- Execute the organization's Cyber Third-Party Risk Management (TPRM) program, including vendor risk assessments, issue identification, and ongoing monitoring activities.
- Partner with groups inside and outside of IT to ensure third-party technology and security risks are appropriately identified, evaluated, accepted, mitigated, and monitored throughout the vendor lifecycle.
- Assist Information Security leadership to define risk-based requirements for a Critical Data Protection & Monitoring program, including capabilities required for tooling.
- Deploy and tune monitoring capabilities to detect and respond to key data security risks, including data exfiltration, unauthorized or over-privileged access, inappropriate data sharing, sensitive data exposure, anomalous data movement, and privilege misuse, leveraging targeted monitoring and guardrails where appropriate.
Qualifications • What You'll Bring - Bachelor's Degree in related field or equivalent work experience
- 3-5 years' experience in GRC, TPRM, SOX, Risk Management.
- SAP, Azure, Industrial Control Systems (ICS) experience preferred
- Professional certification such as CISA, CRISC, CISSP, CISM, CGEIT, or CIA, or demonstrated progress toward a relevant certification preferred.
- Experience in a publicly traded company or other environment subject to SOX, external audit, and formalized IT control requirements.
Working Conditions/Environment Working Conditions/Environment: Works in a normal office environment where the employee is regularly required to speak, see, hear, sit, stand, talk, type, walk and bend while moving about the facility. The noise level in the office is quiet. Occasional travel to plants or meetings is required.
