IT GRC Lead: Policy, Risk & Audit Leader

Core Specialty Insurance Holdings, Inc.; Cincinnati (OH); On-site; USD 110,000 - 150,000; Full time

Benefits offered by this job

Medical Insurance

401(k) match

Wellness program

Job summary

Core Specialty Insurance Holdings, Inc. is seeking an IT GRC Lead Analyst to oversee governance, risk, and compliance activities across the IT organization.

This role partners with IT leadership, cybersecurity, internal/external audit, and risk teams to mature controls, monitoring, and policy governance in alignment with SOX, NYDFS, COBIT, NIST, ISO 27001, and other frameworks. The Lead Analyst will drive control testing, risk assessments, evidence validation, and remediation tracking, while

Qualifications

• Bachelor's degree or equivalent in Information Systems, Cybersecurity, Risk Management, Information Assurance, Business Administration, or related field.
• 5+ years of experience in IT Governance, Risk Management, Compliance, IT Audit, Cybersecurity Governance, Internal Controls, or related tech risk discipline.
• Demonstrated experience leading or coordinating IT compliance programs, control monitoring, risk assessments, governance initiatives, audits, and remediation.
• Experience with SOX, NYDFS, HIPAA, ISO 27001, NIST CSF, COBIT, COSO, privacy regulations, or similar frameworks.
• Experience developing, maintaining, and interpreting IT policies, standards, procedures, control documentation, and governance artifacts.
• Experience performing risk assessments, compliance reviews, control evaluations, certification activities, and control attestation processes.
• Experience supporting external/internal audits, regulatory examinations, and management responses.
• Experience preparing executive reporting, dashboards, KPIs, KRIs, and compliance status updates.
• Experience managing risk registers, corrective action plans, findings, and remediation tracking.
• Experience collaborating with technology, security, legal, privacy, audit, business, and executive stakeholders in regulated environments.
• Experience using GRC, reporting, workflow, and evidence management tools (Jira, Confluence, SharePoint, Power BI, Microsoft 365).
• Professional certifications such as CISA/CRISC/CISSP/CISM/CGEIT or ISO 27001 Lead Auditor/Lead Implementer preferred.

Responsibilities

• Lead IT GRC activities across IT governance, risk, and compliance under AVP direction.
• Coordinate team activities and perform key deliverables: risk assessments, control reviews, evidence validation, remediation tracking.
• Lead policy, standards, and procedure reviews; document control ownership; framework mapping; governance reporting.
• Perform risk assessments with risk ratings, remediation actions, and closure tracking.
• Support IT control testing, evidence review, issue identification, remediation tracking, and validation of actions.
• Prepare evidence for audits, manage requests, and support audit readiness.
• Maintain IT GRC artifacts: risk registers, control matrices, narratives, testing records, governance dashboards.
• Monitor and report IT GRC KPIs/KRIs, audit issues, control gaps, and remediation progress.

Skills

IT governance

IT risk management

IT compliance

audit readiness

control testing

stakeholder management

leadership

Education

Bachelor's degree or equivalent in Information Systems/Cybersecurity/Risk Management/Information Assurance/Business Administration

Tools

Jira

Confluence

SharePoint

Power BI

Microsoft 365

Job description

Core Specialty Insurance Holdings, Inc. is seeking an IT GRC Lead Analyst to oversee governance, risk, and compliance activities across the IT organization.

This role partners with IT leadership, cybersecurity, internal/external audit, and risk teams to mature controls, monitoring, and policy governance in alignment with SOX, NYDFS, COBIT, NIST, ISO 27001, and other frameworks. The Lead Analyst will drive control testing, risk assessments, evidence validation, and remediation tracking, while