Hybrid IT GRC Lead Analyst | Risk & Compliance

Kalepa; Cincinnati (OH); Hybrid; USD 110,000 - 150,000; Full time

Benefits offered by this job

Medical Insurance

Dental Insurance

401(k) Plan

Wellness program

Job summary

Kalepa is seeking an IT GRC Lead Analyst in Cincinnati, OH, reporting to the AVP of IT Compliance. The role leads governance, risk, and compliance activities and partners with IT leadership, cybersecurity, and auditors to mature the GRC program.

Responsibilities include policy governance, control testing, risk assessments, evidence validation, and remediation tracking, with a focus on strong documentation and governance dashboards.

Qualifications

• Bachelor's degree or equivalent experience in a relevant field.
• 5+ years of experience in IT Governance, Risk Management, Compliance, IT Audit, or related tech risk.
• Proven experience leading IT compliance programs, control monitoring, and remediation efforts.
• Experience with SOX, NYDFS, HIPAA, ISO 27001, NIST CSF, COBIT, COSO, or similar frameworks.

Responsibilities

• Lead IT GRC activities across governance, risk, and compliance.
• Coordinate risk assessments, control reviews, evidence validation, and remediation tracking.
• Support audit readiness and respond to auditor requests.
• Develop and maintain risk registers, control matrices, and governance dashboards.
• Collaborate with IT, cybersecurity, internal audit, and business stakeholders.

Skills

IT governance

IT risk management

IT compliance

framework mapping

policy governance

communication

Education

Bachelor's degree in Information Systems / Cybersecurity / Risk Management or related field

Tools

Jira

Confluence

SharePoint

Microsoft 365

Power BI

Job description

Kalepa is seeking an IT GRC Lead Analyst in Cincinnati, OH, reporting to the AVP of IT Compliance. The role leads governance, risk, and compliance activities and partners with IT leadership, cybersecurity, and auditors to mature the GRC program.

Responsibilities include policy governance, control testing, risk assessments, evidence validation, and remediation tracking, with a focus on strong documentation and governance dashboards.