{"id":2571126,"url":"https://alion.io/job/core-specialty-insurance-it-grc-lead-analyst","title":"IT GRC Lead Analyst","company":{"id":4418364,"name":"Core Specialty","domain":"corespecialty.com","url":"https://alion.io/company/core-specialty","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Cincinnati, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":96000,"max_usd":198000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":453},"experience_years_min":5,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Confluence","optional":false},{"name":"HIPAA","optional":false},{"name":"Incident Management","optional":false},{"name":"ISO 27001","optional":false},{"name":"Jira","optional":false},{"name":"NIST CSF","optional":false},{"name":"Power BI","optional":false},{"name":"SharePoint","optional":false}],"status":"closed","first_seen_at":"2026-10-07T00:00:00Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-10-28T04:10:04Z","board_verified":false,"closed_at":"2026-10-28T04:10:04Z","days_open":21,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":21},"description":"-\nIT GRC Lead Analyst reports to the AVP of IT Compliance and is responsible for leading governance, risk, and compliance activities across the IT organization. This role supports the design, execution, and ongoing maturity of the IT Governance, Risk, and Compliance (GRC) program by helping ensure IT policies, standards, controls, risks, and compliance activities align with regulatory requirements, audit expectations, enterprise risk objectives, and recognized frameworks such as SOX, NYDFS, COBIT, NIST, and ISO 27001.\nThe IT GRC Lead Analyst serves as a key partner to IT leadership, control owners, cybersecurity, internal audit, external auditors, compliance, and enterprise risk teams. This role leads activities across IT governance, IT risk management, and IT compliance, including control monitoring, risk assessments, audit readiness, issue remediation, policy governance, framework alignment, reporting, and continuous improvement.\nKey Accountabilities/Deliverables:\nLead and directly execute day-to-day IT GRC activities across IT governance, IT risk, and IT compliance under the direction of the AVP of IT Compliance.\nSupport the execution and maturity of the IT GRC program by both coordinating team activities and personally performing key deliverables, including risk assessments, control reviews, evidence validation, audit support, and remediation tracking.\nLead and perform IT governance activities, including policy, standard, and procedure reviews; control ownership documentation; framework mapping; exception tracking; approval evidence; and governance reporting.\nConduct IT risk assessments, including identifying risks, evaluating control design and operating effectiveness, documenting findings, assigning risk ratings, recommending remediation actions, and tracking issues through closure.\nPerform IT compliance monitoring activities, including control testing, evidence review, issue identification, remediation tracking, and validation of corrective actions.\nCoordinate and actively support audit readiness efforts by managing evidence requests, preparing control owners, reviewing documentation, tracking audit deliverables, and responding to internal and external auditor requests.\nPrepare and maintain IT GRC artifacts, including risk registers, control matrices, control narratives, testing records, audit artifacts, remediation trackers, policy inventories, issue logs, and governance dashboards.\nMonitor, analyze, and report on IT GRC KPIs, KRIs, audit issues, control gaps, policy exceptions, remediation progress, overdue items, and emerging areas of concern.\nPartner directly with IT control owners to strengthen control design, improve process documentation, resolve control gaps, and support sustainable remediation of findings.\nServe as a key working liaison between IT, cybersecurity, internal audit, external audit, enterprise risk, compliance, legal, control owners, and business stakeholders on GRC-related activities.\nProvide hands-on guidance, coaching, task coordination, and quality review for IT GRC analysts, including reviewing evidence, workpapers, risk assessments, status updates, and remediation documentation.\nIdentify and implement improvements to IT GRC processes, reporting, evidence collection, governance workflows, control monitoring, and audit readiness practices.\nEscalate significant risks, control gaps, overdue remediation items, audit concerns, and governance issues to the AVP of IT Compliance in a timely manner.\nSupport IT compliance and governance awareness by helping communicate policy expectations, control responsibilities, risk obligations, and audit readiness requirements across IT. \nTechnical Knowledge and Understanding:\nStrong understanding of IT governance, IT risk management, and IT compliance principles, including how policies, standards, risks, controls, and evidence support regulatory, audit, and business requirements.\nWorking knowledge of key frameworks, standards, and regulations such as SOX, NYDFS Cybersecurity Regulation, COBIT, NIST CSF, ISO 27001, COSO, HIPAA, and other applicable requirements.\nStrong understanding of IT General Controls, including access management, privileged access, change management, computer operations, backup and recovery, incident management, system development lifecycle, and third-party technology controls.\nHands-on knowledge of IT control testing practices, including test planning, evidence review, control performance validation, issue documentation, remediation tracking, and management reporting.\nKnowledge of IT governance practices, including policy and standard lifecycle management, control ownership, approval workflows, exceptions, framework mapping, document repositories, and governance dashboards.\nAbility to interpret regulatory, framework, and control requirements and translate them into practical testing procedures, evidence requests, governance activities, risk assessments, and remediation actions.\nUnderstanding of cybersecurity and technology risk areas, including identity and access management, vulnerability management, endpoint security, data protection, logging and monitoring, cloud controls, business continuity, disaster recovery, and third-party risk.\nStrong analytical, documentation, communication, stakeholder management, and leadership skills, with the ability to explain risk, control, and compliance matters to both technical and non-technical stakeholders.\nAbility to lead workstreams while also performing hands-on execution, including reviewing evidence, preparing work papers, documenting findings, tracking remediation, and preparing status reporting.\nRequirements:\nApplicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over work authorization sponsorship now or in the future for this position.\nBachelor's degree in Information Systems, Cybersecurity, Risk Management, Information Assurance, Business Administration, or related field; or equivalent experience.\n5+ years of experience in IT Governance, Risk Management, Compliance, IT Audit, Cybersecurity Governance, Internal Controls, or a related technology risk discipline.\nDemonstrated experience leading or coordinating IT compliance programs, control monitoring activities, risk assessments, governance initiatives, audit engagements, and remediation efforts.\nStrong understanding of governance frameworks, risk management methodologies, internal control concepts, compliance monitoring practices, and issue management processes.\nExperience supporting compliance with regulatory and industry requirements including SOX, NYDFS, HIPAA, ISO 27001, NIST CSF, COBIT, COSO, privacy regulations, or similar frameworks.\nExperience developing, maintaining, and interpreting IT policies, standards, procedures, control documentation, and governance artifacts.\nExperience performing or overseeing risk assessments, compliance reviews, control evaluations, certification activities, and control attestation processes.\nExperience supporting external audits, internal audits, regulatory examinations, customer due diligence activities, and management responses.\nExperience preparing executive reporting, dashboards, metrics, KPIs, KRIs, committee materials, and compliance status updates.\nExperience managing risk registers, corrective action plans, compliance exceptions, findings, and remediation tracking activities.\nExperience collaborating with technology, security, legal, privacy, audit, business, and executive stakeholders in a highly regulated environment.\nExperience using GRC, reporting, workflow, and evidence management tools such as Jira, Confluence, SharePoint, Microsoft 365, Power BI, or similar platforms.\nStrong analytical, organizational, project coordination, and communication skills, including the ability to lead initiatives with minimal supervision.\nProfessional certifications such as CISA, CRISC, CISSP, CISM, CGEIT, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, or equivalent certifications preferred.\nExperience within insurance, financial services, healthcare, or other regulated industries preferred.\n#LI-Hybrid\n-\nAt Core Specialty, you will receive a competitive salary and opportunities for professional development and advancement. We offer medical, dental, vision, and life insurances; short and long-term disability; a Company-match of 100% of a 6% contribution 401(k) plan; an Employee Assistance Plan; Health Savings Account, Flexible Spending Account, Health Reimbursement Account, and a wellness program","description_format":"text","description_chars":8516,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Life insurance","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Property & Casualty Insurance","Security Compliance","Reinsurance"],"lifecycle":[{"event":"open","at":"2026-10-14T22:58:59Z"},{"event":"close","at":"2026-10-28T04:10:04Z"}],"visa":[],"liveness":null,"pay":null,"html_url":"https://alion.io/job/core-specialty-insurance-it-grc-lead-analyst","json_url":"https://alion.io/job/core-specialty-insurance-it-grc-lead-analyst.json","meta":{"generated_at":"2026-11-06T17:21:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":32268,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4418364},"rest":"https://alion.io/mcp/rest/get_company?id=4418364"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcore-specialty-insurance-it-grc-lead-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcore-specialty-insurance-it-grc-lead-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcore-specialty-insurance-it-grc-lead-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/core-specialty-insurance-it-grc-lead-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcore-specialty-insurance-it-grc-lead-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2571126}},{"tool":"search_jobs","arguments":{"company":"corespecialty.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2571126},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}