IT GRC Lead: Governance, Risk & Compliance

Core Specialty Insurance Holdings, Inc.; Cincinnati (OH); Hybrid; USD 110,000 - 140,000; Full time

Benefits offered by this job

Medical, Dental, Vision Insurance

401(k) Company-match

Employee Assistance Plan

Wellness program

Job summary

Core Specialty Insurance Holdings, Inc. is seeking an IT GRC Lead Analyst in Cincinnati to lead governance, risk, and compliance activities across the IT organization.

The role focuses on designing and maturing the GRC program to align with SOX, NYDFS, COBIT, NIST, and ISO 27001, while partnering with IT leadership and audit teams. The ideal candidate will drive risk assessments, control testing, evidence validation, policy governance, and reporting, ensuring timely remediation and governance

Qualifications

• Bachelor’s degree in Information Systems, Cybersecurity, Risk Management, Information Assurance, Business Administration, or related field; or equivalent experience.
• 5+ years of experience in IT Governance, Risk Management, Compliance, IT Audit, Cybersecurity Governance, Internal Controls, or related technology risk discipline.
• Demonstrated experience leading or coordinating IT compliance programs, control monitoring activities, risk assessments, governance initiatives, audit engagements, and remediation efforts.
• Strong understanding of governance frameworks, risk management methodologies, internal control concepts, compliance monitoring practices, and issue management processes.
• Experience using GRC, reporting, workflow, and evidence management tools such as Jira, Confluence, SharePoint, Microsoft 365, Power BI, or similar platforms.

Responsibilities

• Lead IT GRC activities across IT governance, IT risk, and IT compliance under the direction of the AVP of IT Compliance.
• Coordinate team activities and personally perform key deliverables, including risk assessments, control reviews, evidence validation, audit support, and remediation tracking.
• Lead policy, standard, and procedure reviews; framework mapping; exception tracking; governance reporting.
• Conduct IT risk assessments, including identifying risks, evaluating control design and operating effectiveness, documenting findings, and tracking remediation.
• Perform IT compliance monitoring, including control testing, evidence review, issue identification, remediation tracking, and validation of corrective actions.
• Coordinate and support audit readiness by managing evidence requests, preparing control owners, reviewing documentation, and responding to auditor requests.
• Prepare and maintain IT GRC artifacts, risk registers, control matrices, policy inventories, issue logs, and governance dashboards.
• Monitor and report on IT GRC KPIs, KRIs, audit issues, control gaps, and remediation progress.
• Partner with IT control owners to strengthen control design and remediation of findings.
• Serve as liaison between IT, cybersecurity, internal/external audit, enterprise risk, compliance, legal, and business stakeholders on GRC activities.
• Provide guidance and quality review for IT GRC analysts, including reviewing evidence and status updates.
• Identify improvements to IT GRC processes, reporting, and audit readiness practices.
• Escalate significant risks and governance issues to the AVP of IT Compliance.
• Support awareness by communicating policy expectations and risk obligations across IT.

Skills

IT Governance

IT Risk Management

IT Compliance

Regulatory Knowledge

Stakeholder Management

Leadership

Education

Bachelor’s degree in Information Systems or related field

Tools

Jira

Confluence

SharePoint

Microsoft 365

Power BI

Job description

Core Specialty Insurance Holdings, Inc. is seeking an IT GRC Lead Analyst in Cincinnati to lead governance, risk, and compliance activities across the IT organization.

The role focuses on designing and maturing the GRC program to align with SOX, NYDFS, COBIT, NIST, and ISO 27001, while partnering with IT leadership and audit teams. The ideal candidate will drive risk assessments, control testing, evidence validation, policy governance, and reporting, ensuring timely remediation and governance