Lead GRC Analyst

Kalepa; Northern (KY); Hybrid; USD 110,000 - 160,000; Full time

Job summary

MSIG USA, the US-based subsidiary of MS&AD Insurance Group, is seeking a Lead, Governance, Risk & Compliance (GRC) to mature security governance, risk management, and compliance activities. This role focuses on hands-on execution, regulatory compliance, audits, and policy governance while offering growth into leadership responsibilities.

The ideal candidate has 5–8+ years in GRC or IT risk, familiarity with NYDFS 23 NYCRR 500 and frameworks like NIST CSF or ISO 27001, and experience in

Qualifications

• 5–8+ years of experience in GRC, IT risk management, IT audit, or information security.
• Hands-on experience with regulatory compliance, audits, or risk assessments.
• Knowledge of NYDFS 23 NYCRR 500 and at least one major framework (NIST CSF, ISO 27001, etc.)
• Experience maintaining risk registers, audit evidence, or compliance documentation.

Responsibilities

• Maintain and operate the security governance and compliance program.
• Support regulatory compliance, audits, and risk assessments.
• Coordinate audit activities and assist with remediation tracking.
• Develop and maintain security policies and standards.
• Perform vendor security risk assessments and support due diligence.
• Prepare GRC metrics and leadership reports.

Skills

GRC

IT risk management

IT audit

information security

Tools

ServiceNow GRC

Archer

OneTrust

Job description

## Lead GRC AnalystApply: Hybrid: NJ-Warren: Full time: Posted 8 Days Ago: JR-001021MSIG USA continues to grow!**Company Overview:**MSIG USA is the US-based subsidiary of MS&AD Insurance Group Holdings, Inc., one of the world’s top P&C carriers and a global Class 15 insurer, with A+ ratings and a reach that spans 40+ countries and regions. Leveraging our 350-year heritage, MSIG USA brings the financial strength, expertise, and global footprint to offer commercial insurance solutions that address your business’s unique risks.**Role Overview**MSIG is seeking a Lead**, Governance, Risk & Compliance (GRC)** to help run and mature core security governance, risk management, and compliance activities. This role is ideal for an experienced **GRC analyst, IT risk professional, or IT auditor** who is ready to take on broader ownership, mentor others, and grow into a people or program leadership position.The Manager will be **hands-on and execution-focused**, supporting regulatory compliance, audits, IT risk management, and policy governance. While the role will contribute to leadership reporting, **primary Board and executive-facing responsibilities are limited** and supported by senior security leadership.**Key Responsibilities****1. Governance & Compliance Execution*** Maintain and operate MSIG’s security governance and compliance program* Support compliance with key regulations and frameworks (e.g., NYDFS 23 NYCRR 500, HIPAA, GDPR, NIST CSF, ISO 27001)* Track compliance obligations, evidence, and deadlines using defined processes and tools* Assist with monitoring regulatory changes and assessing their operational impact**2. IT Risk Management*** Conduct and support IT and security risk assessments across infrastructure, applications, and cloud environments* Maintain the IT risk register, including risk documentation, remediation tracking, and status updates* Partner with technical teams to document controls and support risk remediation efforts**3. Audit & Regulatory Support*** Coordinate internal and external audit activities, including evidence collection and response tracking* Support interactions with auditors and regulators, with senior leadership leading formal communications* Track audit findings and assist with remediation planning and follow-up**4. Policy & Standards Management*** Support the development, review, and maintenance of security and IT policies and standards* Manage policy review cycles and ensure documentation remains current and accessible* Help promote awareness and adoption of security policies across the organization**5. Third-Party Risk Management (TPRM)*** Perform vendor and third-party security risk assessments* Maintain vendor risk documentation, findings, and remediation tracking* Partner with Procurement and Legal to support security due diligence activities**6. Reporting & Program Support*** Prepare GRC metrics, dashboards, and summary reports for security leadership* Contribute to leadership and management-level reporting on risk and compliance posture* Support continuous improvement initiatives across the GRC program**Qualifications****Required*** 5–8+ years of experience in GRC, IT risk management, IT audit, or information security* Hands-on experience with regulatory compliance, audits, or risk assessments* Working knowledge of NYDFS Cybersecurity Regulation (23 NYCRR 500) and at least one major framework (NIST CSF, ISO 27001, etc.)* Experience maintaining risk registers, audit evidence, or compliance documentation* Strong written communication skills with the ability to document risks, controls, and findings clearly**Preferred*** Experience in insurance or financial services* Familiarity with GRC tools (e.g., ServiceNow GRC, Archer, OneTrust, or similar)* Exposure to cloud environments (Azure and/or AWS)* Relevant certifications such as CISA, CRISC, CISM, or CISSP (or actively pursuing)