Senior IT GRC Analyst: Governance, Risk & Compliance

WesBanco, Inc.; Columbus (OH); On-site; USD 100,000 - 150,000; Full time

Job summary

WesBanco, Inc. is seeking an experienced IT risk and compliance professional to lead the enterprise GRC program and ensure technology practices align with regulatory expectations, enterprise risk appetite, and industry frameworks including NIST CSF 2.0, FFIEC IT Handbook, CIS Controls, and the CRI Profile.

The role supports policy hierarchy maintenance, risk assessments, control self‑assessments, third‑party risk management, regulatory examinations, and reporting of KRIs.

Qualifications

• Bachelor's degree in Information Systems, Business, Computer Science, or related field.
• Minimum of 4 years of relevant experience in a regulated financial institution preferred.
• Professional certifications such as CRISC, CISA, CISM, CGEIT, or CISSP are preferred.

Responsibilities

• Maintains and enforces the technology policy hierarchy and standards aligned to NIST CSF 2.0 and FFIEC guidance.
• Supports IT risk assessment programs, risk register, scoring, and remediation workflows.
• Performs control self-assessments across IT domains (identity, access, change, vulnerability, data protection).
• Supports Third-Party Risk Management (TPRM) activities including vendor due diligence and monitoring.
• Assists with regulatory examinations (OCC, FDIC, Fed) and audits, tracking findings to closure.
• Develops technology risk metrics and KRIs for governance committees.
• Supports AI governance activities (NIST AI RMF, ISO/IEC 42001) including AI inventory and lifecycle controls.

Skills

GRC platforms

FFIEC IT Handbook

NIST CSF 2.0

CIS Controls v8

NIST SP 800-53

TPRM

AI governance

Regulatory compliance

Education

Bachelor's degree (Information Systems/Business/CS)

Tools

ServiceNow GRC

Archer

Job description

WesBanco, Inc. is seeking an experienced IT risk and compliance professional to lead the enterprise GRC program and ensure technology practices align with regulatory expectations, enterprise risk appetite, and industry frameworks including NIST CSF 2.0, FFIEC IT Handbook, CIS Controls, and the CRI Profile.

The role supports policy hierarchy maintenance, risk assessments, control self‑assessments, third‑party risk management, regulatory examinations, and reporting of KRIs.